linux-kernel - Re: [PATCH] 2.6.23: Filesystem capabilities 0.17

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071105110925.GC9561@duck.suse.cz>
Date:	Mon, 5 Nov 2007 12:09:26 +0100
From:	Jan Kara <jack@...e.cz>
To:	Olaf Dietsche <olaf+list.linux-kernel@...fdietsche.de>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] 2.6.23: Filesystem capabilities 0.17

On Thu 01-11-07 23:22:51, Olaf Dietsche wrote:
> Jan Kara <jack@...e.cz> writes:
> 
> > On Thu 01-11-07 20:49:32, Olaf Dietsche wrote:
> >> Jan Kara <jack@...e.cz> writes:
> >> 
> >> >> This patch implements filesystem capabilities. It allows to
> >> >> run privileged executables without the need for suid root.
> >> >   Hmm, is there some "design document" so that one does not have to poke
> >> > through the code and find out what it's actually trying to do?
> >> 
> >> What do you mean with "trying to do"? I thought this is obvious, it
> >> provides executables with filesystem capabilities.
> >   Well, yes, that was obvious but I rather meant "how is it doing it?".
> > So where does it store these bits and such.
> 
> The bits are stored in a sparse file named /.capabilities in the
> directory of the mount point, where the corresponding executable
> lives. The inode number of the file is the index into this file.
  Thanks for explanation. I guess I should warn you a bit :) Quota stores
it's data (which are in a certain sence filesystem metadata) in regular
files and believe me it brings some unexpected complexity. Especially
avoiding deadlocks with journaled filesystems was quite complex for quotas
(you cannot call filesystem write function when a transaction is already
started or deadlocks can happen).
  I guess with capabilities you need to write to the file only in some
special situations but still you could have problems with that.

								Honza
-- 
Jan Kara <jack@...e.cz>
SUSE Labs, CR
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/