Messages in this thread | | | Date | Sun, 2 May 1999 22:54:45 +0200 | From | Pavel Machek <> | Subject | Re: Capabilities: ALPHA time |
| |
Hi!
> > Capabilities reached state where they are actually usefull. (I was > > able to lower permissions for programs like ping and rlogin). There > > are still some problems with headers (I include > > /usr/src/linux/include/linux/capability.h directly -- that's ugly), > > and there are problems with applications which do getuid() and then > > print failed - must be run as root when they actually do not need ~~~~~ <- fping is written there
> > root > > at all (fping). Diff against kernel follows, and diff against > Flood pinging is a policy issue. We don't want just anybody flood ping so > it checks that the ruid is 0. May I ask exactly what went wrong with > "printing"?
fping is not designed for flood pinging, and is normally being suid root. If I want to keep current policy and make it more secure, I need to give it enough permissions. But it checks euid() and fails. Which is bug in my eyes. Unfortunately X behaves just the same.
> Your patch doesn't handle notes of different types if I'm reading it > correctly and it must be first note . I'll look into how the elf > stuff
Well, it is probably ok to consider just first note (constant overhead). I'll modify addnote (done now) to force caps note the first.
> works closer and what kinds of information and sanity checks we can do so > that the kmalloc isn't a DoS problem. I'll relook into both versions of > the elfcap note finder stuff. It's definately 2.3ish though.
kmalloc is probably not too big problem (Jeremy tells me there are other places like that), but it is ugly. I need constant ammount of work better :-).
If elf capabilities are definitely 2.3ish (I do not see -- it is really trivial patch), may I ask for having 2.3.0 soon?
Pavel -- I'm really pavel@atrey.karlin.mff.cuni.cz. Pavel Look at http://atrey.karlin.mff.cuni.cz/~pavel/ ;-).
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |