Quoting Serge Aleynikov ([email protected]):
> Serge (what a nice name! ;-) ),
>
> Let me give you an example where we found this patch very useful.
>
> A 3rd party library that we bought implemented a user-level SCTP
> protocol by opening raw sockets. This required our application to run
> as root. However, we didn't want for it to run as root, and wanted to
> set the CAP_NET_RAW option and have the interaction with the raw socket
> survive after when we switch the effective user away from root.
>
> When reading "man capabilities" we found:
>
> "If a process that has a 0 value for one or more of its user IDs
> wants to prevent its permitted capability set being cleared when it
Right, *permitted*.
> resets all of its user IDs to non-zero values, it can do so using
> the prctl() PR_SET_KEEPCAPS operation."
>
> Correct me if I am wrong, but I believe that this sentence says just
> what I described above.
No, you're asking for the effective set to also not be cleared, but the
manpage only says the permitted set is maintained.
> If so, the previously attached patch has the
> behavior described in the man page.
Are you able to modify the source of the application you bought? If so,
you can trivially fix it to do what you need by doing a cap_set_proc
after the suid as I described before, i.e.
ret = setuid();
caps = cap_from_text("cap_net_raw=e");
ret = cap_set_proc(caps);
Is that an option?
-serge
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
