Messages in this thread | | | Date | Tue, 03 Feb 2015 07:40:24 -0800 | From | Casey Schaufler <> | Subject | Re: [capabilities] Allow normal inheritance for a configurable set of capabilities |
| |
On 2/3/2015 7:17 AM, Christoph Lameter wrote: > On Mon, 2 Feb 2015, Andy Lutomirski wrote: > >> None of this could address the problem here, though: if I hold a >> capability and I want to pass that capability to an exec'd helper, I >> shouldn't need the fs's help to do this. > Amen! > That's completely consistent with the notion that if a binary has no file capabilities (as opposed to a set that contains no capabilities) the process capabilities are unchanged by exec(). If the binary does have capabilities, however, it must always apply them. That should be obvious. In your case, the helper would have no file capabilities, and hence get whatever the invoker has. A program that should never run with capabilities should have a file attribute stating such. Where it gets sticky is the case where you want inheritance when invoked by one service and no capabilities when invoked from another. If we live with the notion that you have to choose this is easy enough to solve.
| |