On Thu, Aug 28, 2008 at 05:45:34PM +0300, Markku Savela wrote:

quoted text
>

> > From: Pavel Machek

>

> > Yes, you need upcoming filesystem capabilities.  Binary may not

> > inherit capabilities unless filesystem flags permit that.

>

> I think this is wrong. Normal executables inherit uid/gid and

> supplementary groups by default. Why should capabilities be any

> different?

Well, because that's not the what the POSIX draft specification (and

the rest of the Unix industry who were striving to meet the US

Department of Defense's "B2 by '92" initiative) ended up implementing.
The reason for that was to avoid bugs where a program that wasn't

expecting to be setuid (or just written by a stupid progammer) exec's

some program which wasn't expecting to have root privileges then bad

things happen.  The classic example of this was running the mail

program, which was setuid or setgid to the mail user/group, and then

typing "!/bin/sh" which would exec a shell running with those

privileges (because the mail program didn't know to drop its

privileges).
So in the capabilities model, the capabilities do *not* inherit unless

the a particular file explicitly states that it should inherit the

capabilities.  It's the principle of least privilege taken to its

logical conclusion.
						- Ted

--

unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in

the body of a message to majordomo@vger.kernel.org

More majordomo info at  http://vger.kernel.org/majordomo-info.html

Please read the FAQ at  http://www.tux.org/lkml/