lkml.org 
[lkml]   [2002]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectANN: capwrap - grant capabilities to executables
I've written a small module¹ that enables the use of Linux capabilities
on filesystems that do not support them. It is similar in spirit to ELF
capabilities hack² but is not specific to the ELF executable format and
is implemented as separate kernel module.

To grant capabilities to an executable, a small wrapper file is created
that includes the path to an executable followed a capability set
written in hexadecimal. When this file is executed by the kernel, the
executable is granted the specified capabilities. The wrapper file must
be owned by root and have the SUID bit set.

For example, to remove the SUID bit on the ping program while retaining
its functionality:

# chmod -s /bin/ping
# mv /bin/ping /bin/ping_real
# echo '&/bin/ping_real 2000' > /bin/ping
# chmod +xs /bin/ping

Comments welcome.

Neil


¹ http://arctrix.com/nas/linux/capwrap.tar.gz
² http://atrey.karlin.mff.cuni.cz/~pavel/elfcap.html
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:25    [W:0.041 / U:0.420 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site