Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH] afs: proc cells and rootcell are writeable | Date | Fri, 31 Jan 2014 00:31:21 +0000 |
| |
David Howells <dhowells@redhat.com> wrote:
> > > I think this is a pretty strong argument. Counter-arguments, anybody? > > > > Yes. CAP_DAC_READ_SEARCH. > > No, it would seem unlikely it's that, but I guess there's another capability > override because the process is owned by root.
CAP_DAC_OVERRIDE, I think.
int generic_permission(struct inode *inode, int mask) { ... /* * Read/write DACs are always overridable. * Executable DACs are overridable when there is * at least one exec bit set. */ if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) if (inode_capable(inode, CAP_DAC_OVERRIDE)) return 0; ... }
David
| |