From: Sascha Silbe (sascha-ml-vserver_at_silbe.org)
Date: Fri 30 Jan 2004 - 22:43:50 GMT

• Previous message: Igor Seletskiy: "Re: [Vserver] future 2.6 development ..."

Hi!

Posting via the gmane.org news gate does not seem to work, so I'm
reposting manually.

While hacking on my srvtools (something similar to the vserver user
space
tools, but with a different design), I made a frightening discovery:

root_at_hybrid:/# reducecap --secure /bin/sh -c 'getpcaps $$'
Executing
Capabilities for `11054': =eip cap_setpcap-eip
root_at_hybrid:/# execcap = /bin/sh -c 'getpcaps $$'
Capabilities for `11084': =ep cap_setpcap-ep
root_at_hybrid:/# cat /proc/sys/kernel/cap-bound
0
root_at_hybrid:/# uname -r
2.4.21-hybrid-1

This is exactly the same as on a capability-disabled system (where I'd
actually
expect that behaviour):

root_at_odin:~# execcap = /bin/sh -c 'getpcaps $$'
Capabilities for `29497': =ep cap_setpcap-ep
root_at_odin:~# cat /proc/sys/kernel/cap-bound
-257

Actually one of my services ("virtual servers") is running with FULL
root
privileges now:

root_at_hybrid:/# getpcaps `vps auxww |grep '[ ]/bin/clockspeed'|tr -s '
'|cut -d ' ' -f 1`
Capabilities for `root': =eip cap_setpcap-eip

What the hell has happened to POSIX capability support in the latest 2.4
kernels?

PS: Yes, 'reducecap --show' does give the same output as 'getpcaps $$',
only
in a much more verbose fashion.

CU/Lnx Sascha

-- 
Registered Linux User #77587 (http://counter.li.org/)
bomb terrorist afghanistan PGP encrypt CIA FBI BND MAD StaSi anschlag 
strike sex pussy xxx kill bj hitler Gates MS Windows ZV ZDV

• application/pgp-signature attachment: stored

• Previous message: Igor Seletskiy: "Re: [Vserver] future 2.6 development ..."