linux-kernel - Re: [PATCH] exporting capability code/name pairs (try #4)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 13 Feb 2008 17:14:08 +0900
From:	Kohei KaiGai <kaigai@...jp.nec.com>
To:	Alexey Dobriyan <adobriyan@...il.com>
CC:	"Serge E. Hallyn" <serue@...ibm.com>,
	"Andrew G. Morgan" <morgan@...nel.org>, akpm@...l.org,
	jmorris@...ei.org, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: Re: [PATCH] exporting capability code/name pairs (try #4)

Alexey Dobriyan wrote:
> On Tue, Feb 12, 2008 at 10:10:06AM +0900, Kohei KaiGai wrote:
>> Alexey Dobriyan wrote:
>>> On Fri, Feb 08, 2008 at 06:42:09PM +0900, Kohei KaiGai wrote:
>>>> [kaigai@...a ~]$ ls -R /sys/kernel/capability/
>>>> /sys/kernel/capability/:
>>>> codes  names  version
>>>>
>>>> /sys/kernel/capability/codes:
>>>> 0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
>>>> 1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9
>>>>
>>>> /sys/kernel/capability/names:
>>>> cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
>>>> cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
>>>> cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
>>>> cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
>>>> cap_dac_read_search  cap_mac_override      cap_setuid      
>>>> cap_sys_resource
>>>> cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
>>>> cap_fsetid           cap_net_admin         cap_sys_boot    
>>>> cap_sys_tty_config
>>>> cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
>>>> cap_ipc_owner        cap_net_broadcast     cap_sys_module
>>>> [kaigai@...a ~]$ cat /sys/kernel/capability/codes/20
>>>> cap_sys_pacct
>>>> [kaigai@...a ~]$ cat /sys/kernel/capability/names/cap_mknod
>>>> 27
>>>> [kaigai@...a ~]$
>>>> --------------------------------------------------------
>>>> Any comment please.
>>> You don't like 1 (one) /proc/capabilities, why?
>> I have no preference whether a single /proc/capabilities, or the current 
>> approach.
>> However, this idea requires a bit more cost to lookup a capability not 
>> sequencially.
> 
> And I'm sure far less memory wasted at runtime.
> 
> Also, adding config option for one file/directory seems ridiculous to
> me. And changelog completely fails to mention why it is useful to lookup
> capabilities by name and number -- CAP_SYS_* numbers are part of ABI,
> they won't change.

The codes of capabilities are not removed/modified, but a new one
may be added. In actually, two capabilities will be added at 2.6.25.
If we don't have dynamic interface to obtain the list of capabilities,
libcap built on older kernel cannot work enough on the latest one.

I'll add a description to make clear its purpose in the next patch.
Please wait for a while.

Thanks,
-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@...jp.nec.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/