Messages in this thread Patch in this message | | | Date | Wed, 8 Jun 2005 15:27:15 -0500 (CDT) | From | Manfred Georg <> | Subject | [PATCH] capabilities not inherited |
| |
Hi,
I was working with passing capabilities through an exec and it didn't do what I expected it to. That is, if I set a bit in the inherited capabilities, it is not "inherited" after an exec(). After going through the code many times, and still not understanding it, I hacked together this patch. It probably has unforseen side effects and there was probably some reason it was not done in the first place.
Thanks for the kernel, I have a new found appreciation for it.
Manfred
Patch against 2.6.12-rc6:
Signed-off-by: Manfred Georg <mgeorg@arl.wustl.edu>
diff -uprN -X dontdiff linux-2.6.12-rc6/security/commoncap.c linux/security/commoncap.c --- linux-2.6.12-rc6/security/commoncap.c 2005-03-02 01:38:07.000000000 -0600 +++ linux/security/commoncap.c 2005-06-08 14:02:21.000000000 -0500 @@ -113,10 +113,11 @@ int cap_bprm_set_security (struct linux_ { /* Copied from fs/exec.c:prepare_binprm. */
- /* We don't have VFS support for capabilities yet */ - cap_clear (bprm->cap_inheritable); - cap_clear (bprm->cap_permitted); - cap_clear (bprm->cap_effective); + bprm->cap_inheritable = current->cap_inheritable; + bprm->cap_permitted = cap_intersect(current->cap_inheritable, + current->cap_permitted); + bprm->cap_effective = cap_intersect(bprm->cap_permitted, + current->cap_effective);
/* To support inheritance of root-permissions and suid-root * executables under compatibility mode, we raise all three - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |