About this list Date view Thread view Subject view Author view Attachment view

From: Sascha Silbe (sascha-ml-vserver_at_silbe.org)
Date: Fri 30 Jan 2004 - 22:43:50 GMT


Hi!

Posting via the gmane.org news gate does not seem to work, so I'm
reposting manually.

While hacking on my srvtools (something similar to the vserver user
space
tools, but with a different design), I made a frightening discovery:

root_at_hybrid:/# reducecap --secure /bin/sh -c 'getpcaps $$'
Executing
Capabilities for `11054': =eip cap_setpcap-eip
root_at_hybrid:/# execcap = /bin/sh -c 'getpcaps $$'
Capabilities for `11084': =ep cap_setpcap-ep
root_at_hybrid:/# cat /proc/sys/kernel/cap-bound
0
root_at_hybrid:/# uname -r
2.4.21-hybrid-1

This is exactly the same as on a capability-disabled system (where I'd
actually
expect that behaviour):

root_at_odin:~# execcap = /bin/sh -c 'getpcaps $$'
Capabilities for `29497': =ep cap_setpcap-ep
root_at_odin:~# cat /proc/sys/kernel/cap-bound
-257

Actually one of my services ("virtual servers") is running with FULL
root
privileges now:

root_at_hybrid:/# getpcaps `vps auxww |grep '[ ]/bin/clockspeed'|tr -s '
'|cut -d ' ' -f 1`
Capabilities for `root': =eip cap_setpcap-eip

What the hell has happened to POSIX capability support in the latest 2.4
kernels?

PS: Yes, 'reducecap --show' does give the same output as 'getpcaps $$',
only
in a much more verbose fashion.

CU/Lnx Sascha

-- 
Registered Linux User #77587 (http://counter.li.org/)

bomb terrorist afghanistan PGP encrypt CIA FBI BND MAD StaSi anschlag strike sex pussy xxx kill bj hitler Gates MS Windows ZV ZDV


_______________________________________________ Vserver mailing list Vserver_at_list.linux-vserver.org http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 30 Jan 2004 - 22:51:02 GMT by hypermail 2.1.3