[lkml]   [2002]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC] Making capabilites useful with legacy apps

> In attempt to make capabilites more useful before the filesytem support
> arrives, I would like to "wrap" non-capabilities aware apps.
> For example:
> # capwrap --user nobody --grp nobody --cap CAP_NET_BIND_SERVICE nc -l -p 80

That looks pretty nice...

> This wrapper[1] (that would increase security) won't work with the current
> kernel though, because at step 6, all capabilities are cleared.

This should be fixed, then.
PS: you could ptrace attach yourself, fork and exec on root, and then force
newly exec-ed app to give up id... But that's ugly and complicated hack.

Philips Velo 1: 1"x4"x8", 300gram, 60, 12MB, 40bogomips, linux, mutt,
details at

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:26    [W:0.059 / U:4.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site