[lkml]   [2003]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: execve setting capabilities incorrectly ?
execcap doesn't work.

Long story: Linux capabilities don't really work as POSIX intended them
to work without filesystem support. I am not working on this these days,
although there are some mostly complete patches on for old

Because of the ambiguity of what setuid() does with the behavior I
discussed in this old email, when combined with certain setuid-0
programs, we had to make the kernel's default policy less like POSIX and
more like the legacy superuser model.

You used to be able to make it work as it did in the examples below by
raising the inheritable set and lowering the cap_bound set (which is
another hack POSIX didn't specify).

In the absence of filesystem support for capabilities, various folk have
come up with their own ways of leveraging the capabilities to implement
some security models. I fear that completing the capability support as
the POSIX draft defines them will break these other approaches.

I hope that helps clarify what you are seeing.


Andrew [who isn't subscribed to the kernel mailing list.]

Don Cohen wrote:
> Please cc me in replies.
> quoting from message dated 1998/06 to this list from Andrew Morgan
> Subject: Fwd: Re: Capabilities
> ...
> [root@godzilla progs]# ./execcap cap_net_bind_service=i sleep 1000 &
> [1] 600
> [root@godzilla progs]# cat /proc/600/status
> ...
> CapInh: 0000000000000400
> CapPrm: 0000000000000400
> CapEff: 0000000000000400
> My corresponding output ends up with
> CapInh: 0000000000000400
> CapPrm: 00000000fffffeff
> CapEff: 00000000fffffeff
> I've tried in 2.4.18 and in 2.2.16, both give the same result so
> I guess it's been this way for some time.
> The caps seem to be set correctly by execcap but execve resets them.
> Is this intentional?
> If so, how is one now supposed to get the desired effects?
> What's really weird (can someone explain this?) is that things
> seem to work better under strace:
> strace ./execcap = head <some file root has no permission to read>
> => permission denied
> whereas without the strace it reads the file.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:32    [W:0.026 / U:1.668 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site