linux-kernel - Re: [PATCH] exporting capability code/name pairs (try #4)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080212215823.GB2144@martell.zuzino.mipt.ru>
Date:	Wed, 13 Feb 2008 00:58:23 +0300
From:	Alexey Dobriyan <adobriyan@...il.com>
To:	Kohei KaiGai <kaigai@...jp.nec.com>
Cc:	"Serge E. Hallyn" <serue@...ibm.com>,
	"Andrew G. Morgan" <morgan@...nel.org>, akpm@...l.org,
	jmorris@...ei.org, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: Re: [PATCH] exporting capability code/name pairs (try #4)

On Tue, Feb 12, 2008 at 10:10:06AM +0900, Kohei KaiGai wrote:
> Alexey Dobriyan wrote:
> >On Fri, Feb 08, 2008 at 06:42:09PM +0900, Kohei KaiGai wrote:
> >>[kaigai@...a ~]$ ls -R /sys/kernel/capability/
> >>/sys/kernel/capability/:
> >>codes  names  version
> >>
> >>/sys/kernel/capability/codes:
> >>0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
> >>1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9
> >>
> >>/sys/kernel/capability/names:
> >>cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
> >>cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
> >>cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
> >>cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
> >>cap_dac_read_search  cap_mac_override      cap_setuid      
> >>cap_sys_resource
> >>cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
> >>cap_fsetid           cap_net_admin         cap_sys_boot    
> >>cap_sys_tty_config
> >>cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
> >>cap_ipc_owner        cap_net_broadcast     cap_sys_module
> >>[kaigai@...a ~]$ cat /sys/kernel/capability/codes/20
> >>cap_sys_pacct
> >>[kaigai@...a ~]$ cat /sys/kernel/capability/names/cap_mknod
> >>27
> >>[kaigai@...a ~]$
> >>--------------------------------------------------------
> >>Any comment please.
> >
> >You don't like 1 (one) /proc/capabilities, why?
> 
> I have no preference whether a single /proc/capabilities, or the current 
> approach.
> However, this idea requires a bit more cost to lookup a capability not 
> sequencially.

And I'm sure far less memory wasted at runtime.

Also, adding config option for one file/directory seems ridiculous to
me. And changelog completely fails to mention why it is useful to lookup
capabilities by name and number -- CAP_SYS_* numbers are part of ABI,
they won't change.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/