Messages in this thread | | | Date | Sun, 15 Mar 2009 08:20:17 +1300 | Subject | Re: VFS, NFS security bug? Should CAP_MKNOD and CAP_LINUX_IMMUTABLE be added to CAP_FS_MASK? | From | Michael Kerrisk <> |
| |
On Sat, Mar 14, 2009 at 6:58 AM, J. Bruce Fields <bfields@fieldses.org> wrote: > On Fri, Mar 13, 2009 at 09:21:23AM +1300, Michael Kerrisk wrote: >> On Fri, Mar 13, 2009 at 5:10 AM, Serge E. Hallyn <serue@us.ibm.com> wrote: >> > Quoting J. Bruce Fields (bfields@fieldses.org): >> >> On Wed, Mar 11, 2009 at 03:53:34PM +0300, Igor Zhbanov wrote: >> >> > Hello! >> >> > >> >> > It seems that CAP_MKNOD and CAP_LINUX_IMMUTABLE were forgotten to be >> >> > added to CAP_FS_MASK_B0 in linux-2.6.x and to CAP_FS_MASK in >> >> > linux-2.4.x. Both capabilities affects file system and can be >> >> > considered file system capabilities. >> >> >> >> Sounds right to me--I'd expect rootsquash to guarantee that new device >> >> nodes can't be created from the network. Cc'ing random people from the >> >> git log for include/linux/capability.h in hopes they can help. >> > >> > Yeah it seems reasonable. If it is, then does that mean that we >> > also need CAP_SYS_ADMIN (to write selinux labels) and CAP_SETFCAP >> > (to set file capabilities) as well? >> >> If a change is made to CAP_FS_MASK, please do remember to CC >> mtk.manpages@gmail.com, and linux-api@. > > OK, that's because the exact set of capabilities that is dropped on > setfsuid is documented in capabilities(7)? (Anywhere else?)
Not that I know of.
-- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ git://git.kernel.org/pub/scm/docs/man-pages/man-pages.git man-pages online: http://www.kernel.org/doc/man-pages/online_pages.html Found a bug? http://www.kernel.org/doc/man-pages/reporting_bugs.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |