lkml.org 
[lkml]   [2015]   [Feb]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] capabilities: Ambient capability set V1
On Wed, Feb 25, 2015 at 02:25:19PM -0600, Christoph Lameter wrote:
> On Wed, 25 Feb 2015, Serge Hallyn wrote:
>
> > Yeah we could make this
>
> Well doing that breaks su.

Don't what exactly? You're saying that doing

pI' = pI
pA' = pA (pA is ambient)
pP' = (X & fP) | (pI & (fI | pA))
pE' = pP' & (fE | pA)

stopped su from having CAP_SETGID while

pI' = pI
pA' = pA (pA is ambient)
pP' = (X & fP) | (pI & (fI | pA))
pE' = pP' & fE

worked? I'll hope you're saying both "fail", in which case

> Its best to leave perm bits untouched.


> christoph@fujitsu-haswell:~$ su
> setgid: Operation not permitted

Did you initialize by running a program to fill your pI?

-serge


\
 
 \ /
  Last update: 2015-02-26 16:41    [W:0.087 / U:0.140 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site