Messages in this thread | | | Date | Sat, 25 Oct 2003 21:51:53 +0200 | From | Pavel Machek <> | Subject | Re: posix capabilities inheritance |
| |
Hi!
> > The code to drop privs is not hard, but it's also not trivial. > > Here's an example code sequence that demonstrates how a setuid-to-root > application could drop all capabilities except for CAP_IPC_LOCK and > then run with the non-privileged uid: > > #include <sys/prctl.h> > #include <sys/capability.h> > > ... > > cap_t c; > > if (prctl(PR_SET_KEEPCAPS, 1UL, 0UL, 0UL, 0UL) < 0 || > seteuid(getuid()) < 0 || > !(c = cap_from_text("cap_ipc_lock=eip")) || > cap_set_proc(c) < 0) > /* handle error */; > > However, I agree that it's often not viable to require application > changes to achieve the desired result.
IIRC, libraries have special startup sections that run before main(). And c++ constructors do, too; so wrapper still might be safer option.
Pavel -- When do you have a heart between your knees? [Johanka's followup: and *two* hearts?] - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |