Messages in this thread | | | Date | Sun, 20 May 2012 13:10:12 +0000 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH] Trace event for capable(). |
| |
Quoting Serge Hallyn (serge@hallyn.com): > > ----- Original message ----- > > On Fri, May 18, 2012 at 3:33 PM, richard -rw- weinberger > > <richard.weinberger@gmail.com> wrote: > > > > > > On Thu, May 17, 2012 at 9:50 PM, Auke Kok <auke-jan.h.kok@intel.com> > > > wrote: > > > > Add a simple trace event for capable(). > > > > > > > > There's been a lot of discussion around capable(), and there > > > > are plenty of tools to help reduce capabilities' usage from > > > > userspace. A major gap however is that it's almost impossible > > > > to see or verify which bits are requested from either userspace > > > > or in the kernel. > > > > > > > > This patch adds a minimal tracer that will print out which > > > > CAPs are requested and whether the request was granted. > > > > > > Can we please have support for user namespaces? > > > At least idicate whether the current namespace is init_user_ns or not. > > > > that was the main reason for sending this out already - that should be > > trivial to add to the trace event, but I haven't looked at namespaces > > yet myself. I'll check it out. > > > > right, trivial to add, but either go through linux-next or wait for Eric's > patchset to move from there to Linus' tree. Print the > from_kuid(&init_user_ns, current_uid()), and if not in init_user_ns then also > print the ns creator and task uid in his own ns. > > I don't think you need to do that right now.
Oh, you'll also need to add the uid (in init_user_ns) of the owner of the target namespace ('ns'). Otherwise, the admin may freak out seeing uid 500 got cap_sys_admin :)
-serge
| |