Messages in this thread | | | Date | Sun, 26 Jan 2014 17:22:28 +0100 | From | "Serge E. Hallyn" <> | Subject | Re: File capabilities are not 'working' and I have no idea why |
| |
Quoting Aaron Jones (aaronmdjones@gmail.com): > > Hello. > > I recently upgraded from 3.10.7 on a long-running box to 3.12.8 on a > new box. I have been using file capabilities for a long time, so that > processes do not need to start as root and drop unnecessary privileges > later. > > For example, there is no reason for my bind9 nameservers to start as > root, except to bind() port 53 and 953. What I did in this case was to > chown it to root:named and chmod it to 0750 and assign > CAP_NET_BIND_SERVICE to it, it then starts as named and works fine. > > I haven't had any issues with this for easily a year, until now. No > matter what I do on this new machine, I cannot get file capabilities > to 'work'. They are set fine, they are read back fine, but they don't > do anything. I have attached my kernel boot log, its configuration and > a test program (build with -std=c99 -lcap-ng). > > My problem follows: > > # strace -f setcap cap_net_bind_service+eip /usr/local/bin/caps 2>&1 \ > | grep xattr > setxattr("/usr/local/bin/caps", "security.capability", \ > "\x01\x00\x00\x02\x00\x04\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00 \ > \x00\x00\x00\x00", 20, 0) = 0 > > # getcap /usr/local/bin/caps > /usr/local/bin/caps = cap_net_bind_service+eip > > $ /usr/local/bin/caps > Effective capabilities: (none) > Permitted capabilities: (none)
Hm, I'm running Ubuntu 3.13.0-5-generic and I do get
serge@tp:~/test$ ./caps Effective capabilities: net_bind_service
Permitted capabilities: net_bind_service
Any chance (grasping for straws here) that the hardening patches are interfering? Can you try hand-building an upstream kernel to test with?
-serge
| |