lkml.org 
[lkml]   [2012]   [Dec]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [RFC] Capabilities still can't be inherited by normal programs
On Sat, Dec 8, 2012 at 3:57 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>
> I just tried to search to find actual uses of pI/fI. Here's what I found:

I downloaded all the Fedora spec files and searched for file
capabilities. Assuming I didn't mess up, here's what I found:

fping.spec:%attr(0755,root,root) %caps(cap_net_raw=ep) %{_sbindir}/fping
fping.spec:%attr(0755,root,root) %caps(cap_net_raw=ep) %{_sbindir}/fping6
glibc.spec:%attr(755,root,root) %caps(cap_chown,cap_fowner=pe)
%{_prefix}/libexec/pt_chown
gnome-keyring.spec:%attr(0755,root,root) %caps(cap_ipc_lock=ep)
%{_bindir}/gnome-keyring-daemon
httpd.spec:%caps(cap_setuid,cap_setgid+pe)
%attr(510,root,%{suexec_caller}) %{_sbindir}/suexec
iputils.spec:%attr(0755,root,root) %caps(cap_net_raw=ep) %{_sbindir}/clockdiff
iputils.spec:%attr(0755,root,root) %caps(cap_net_raw=ep) %{_sbindir}/arping
iputils.spec:%attr(0755,root,root) %caps(cap_net_raw=ep
cap_net_admin=ep) %{_bindir}/ping
iputils.spec:%attr(0755,root,root) %caps(cap_net_raw=ep
cap_net_admin=ep) %{_bindir}/ping6
mtr.spec:%attr(0755,root,root) %caps(cap_net_raw=pe) %{_sbindir}/mtr
policycoreutils.spec:%caps(cap_setpcap,cap_setuid,cap_fowner,cap_dac_override,cap_sys_admin,cap_sys_nice=pe)
%{_sbindir}/seunshare
policycoreutils.spec:%attr(0755,root,root)
%caps(cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe)
%{_bindir}/newrole
rpm.spec:- fix double-free on %caps in spec (#877512)
rsh.spec:%attr(0755,root,root) %caps(cap_net_bind_service=pe) %{_bindir}/rcp
rsh.spec:%attr(0755,root,root) %caps(cap_net_bind_service=pe) %{_bindir}/rlogin
rsh.spec:%attr(0755,root,root) %caps(cap_net_bind_service=pe) %{_bindir}/rsh
systemd.spec:%caps(cap_dac_override,cap_sys_ptrace=pe)
%{_bindir}/systemd-detect-virt
wireshark.spec:%attr(0750, root, wireshark)
%caps(cap_net_raw,cap_net_admin=eip) %{_sbindir}/dumpcap
xorg-x11-server.spec:%global Xorgperms %attr(0711,root,root)
%caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe)

The only inheritable bit is on dumpcap, and it's not necessary there.

--Andy


\
 
 \ /
  Last update: 2012-12-12 20:01    [W:0.122 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site