From: Sascha Silbe (sascha-news-NOSPAM_at_sascha.silbe.org)
Date: Fri 30 Jan 2004 - 21:40:47 GMT
Hi!
While hacking on my srvtools (something similar to the vserver user space
tools, but with a different design), I made a frightening discovery:
root_at_hybrid:/# reducecap --secure /bin/sh -c 'getpcaps $$'
Executing
Capabilities for `11054': =eip cap_setpcap-eip
root_at_hybrid:/# execcap = /bin/sh -c 'getpcaps $$'
Capabilities for `11084': =ep cap_setpcap-ep
root_at_hybrid:/# cat /proc/sys/kernel/cap-bound
0
root_at_hybrid:/# uname -r
2.4.21-hybrid-1
This is exactly the same as on a capability-disabled system (where I'd
actually expect that behaviour):
root_at_odin:~# execcap = /bin/sh -c 'getpcaps $$'
Capabilities for `29497': =ep cap_setpcap-ep
root_at_odin:~# cat /proc/sys/kernel/cap-bound
-257
Actually one of my services ("virtual servers") is running with FULL root
privileges now:
root_at_hybrid:/# getpcaps `vps auxww |grep '[ ]/bin/clockspeed'|tr -s ' '|cut -d ' ' -f 1`
Capabilities for `root': =eip cap_setpcap-eip
What the hell has happened to POSIX capability support in the latest 2.4
kernels?
PS: Yes, 'reducecap --show' does give the same output as 'getpcaps $$', only
in a much more verbose fashion.
CU/Lnx Sascha
-- Registered Linux User #77587 (http://counter.li.org/)bomb terrorist afghanistan PGP encrypt CIA FBI BND MAD StaSi anschlag strike sex pussy xxx kill bj hitler Gates MS Windows ZV ZDV
_______________________________________________ Vserver mailing list Vserver_at_list.linux-vserver.org http://list.linux-vserver.org/mailman/listinfo/vserver