lkml.org 
[lkml]   [2002]   [Oct]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH][RFC] 2.5.42 (2/2): Filesystem capabilities user tool
From
Date
This is the change capabilities tool. It is a first cut at "managing"
capabilities and not very comfortable.

You need to tell where the .capabilities file is. This must be located
in the mountpoint of the filesystem.

Given a filename, how can I locate the mountpoint of the associated
filesystem? If someone knows, how to do this, please tell me.

Example:

# chmod u-s /bin/ping
# chcap /.capabilities 0x2000 0 0x2000 /bin/ping

This sets the effective and permitted CAP_NET_RAW capability for /bin/ping.

Regards, Olaf.

--- /dev/null Thu Mar 21 19:31:20 2002
+++ chcap.c Fri Oct 18 21:02:15 2002
@@ -0,0 +1,74 @@
+#include <asm/types.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/fcntl.h>
+#include <stdio.h>
+#include <unistd.h>
+
+static const char *capfile;
+static struct stat capbuf;
+
+static void chcap(ino_t ino, __u32 *caps)
+{
+ int fd = open(capfile, O_WRONLY);
+ if (fd < 0) {
+ perror(capfile);
+ exit(1);
+ } else {
+ off_t rc = lseek(fd, ino * 3 * sizeof(*caps), SEEK_SET);
+ if (rc == -1)
+ perror(capfile);
+ else
+ write(fd, caps, 3 * sizeof(*caps));
+
+ close(fd);
+ }
+}
+
+int main(int argc, char **argv)
+{
+ __u32 caps[3];
+ int rc;
+ int i = 1;
+
+ if (argc < 6) {
+ fprintf(stderr, "usage: %s /path/to/.capabilities eff inh perm file ...\n", argv[0]);
+ exit(2);
+ }
+
+ capfile = argv[i++];
+ rc = access(capfile, F_OK);
+ if (rc != 0) {
+ int fd = open(capfile, O_CREAT | O_EXCL | O_RDONLY, 0600);
+ if (fd >= 0) {
+ close(fd);
+ } else {
+ perror(capfile);
+ exit(1);
+ }
+ }
+
+ rc = stat(capfile, &capbuf);
+ if (rc != 0) {
+ perror(capfile);
+ }
+
+ caps[0] = strtol(argv[i++], 0, 0);
+ caps[1] = strtol(argv[i++], 0, 0);
+ caps[2] = strtol(argv[i++], 0, 0);
+
+ for (; i < argc; ++i) {
+ struct stat buf;
+ rc = stat(argv[i], &buf);
+ if (rc == 0) {
+ if (buf.st_dev == capbuf.st_dev)
+ chcap(buf.st_ino, caps);
+ else
+ fprintf(stderr, "%s: %s is on different file system\n", argv[i], capfile);
+ } else {
+ perror(argv[i]);
+ }
+ }
+
+ return 0;
+}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-03-22 13:30    [W:1.331 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site