From: Nadav Har'El (nyh_at_nonexisting.hamakor.org.il)
Date: Tue 31 Aug 2004 - 13:52:32 IDT
On Tue, Aug 31, 2004, Nadav Har'El wrote about "Re: I'm not the process you think I am":
> On second thought, while it's easy to have a root (uid 0) owned process
> with lesser privelges (useful for enhanced security), it's less clear how
> to use the "capabilities" mechanism to elevate the capabilities of a non-
> root process. capsetp (controlling another process) might not be allowed
> on standard kernels; And setuid et al. might clear all the capabilities
> while changing the uid :(
Sorry for answering myself like this...
I noticed that a program "sucap" already exists (at least on my old Redhat)
that does exactly what I suggested: changing the user name without losing
the capabilities. Unfortunately, like I feared, it uses capsetp() and
that doesn't work on an unmodified kernel... If you want to use it you'll
need to modify your kernel to enable CAP_SETPCAP by default - see instructions
in
http://www.linuxjournal.com/article.php?sid=5737
This is usually considered a security hole, however.
Good luck in finding a better solution.
-- Nadav Har'El | Tuesday, Aug 31 2004, 14 Elul 5764 nyh_at_math.technion.ac.il |----------------------------------------- Phone +972-523-790466, ICQ 13349191 |Experience is what causes a person to http://nadav.harel.org.il |make new mistakes instead of old ones. ================================================================= To unsubscribe, send mail to linux-il-request_at_linux.org.il with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail linux-il-request_at_linux.org.il
This archive was generated by hypermail 2.1.7 : Tue 31 Aug 2004 - 14:05:39 IDT