| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 12 Mar 2009 11:10:47 -0500 From: "Serge E. Hallyn" <serue@...ibm.com> To: "J. Bruce Fields" <bfields@...ldses.org> Cc: Igor Zhbanov <izh1979@...il.com>, linux-kernel@...r.kernel.org, viro@...iv.linux.org.uk, neilb@...e.de, Trond.Myklebust@...app.com, David Howells <dhowells@...hat.com>, James Morris <jmorris@...ei.org> Subject: Re: VFS, NFS security bug? Should CAP_MKNOD and CAP_LINUX_IMMUTABLE be added to CAP_FS_MASK? Quoting J. Bruce Fields (bfields@...ldses.org): > On Wed, Mar 11, 2009 at 03:53:34PM +0300, Igor Zhbanov wrote: > > Hello! > > > > It seems that CAP_MKNOD and CAP_LINUX_IMMUTABLE were forgotten to be > > added to CAP_FS_MASK_B0 in linux-2.6.x and to CAP_FS_MASK in > > linux-2.4.x. Both capabilities affects file system and can be > > considered file system capabilities. > > Sounds right to me--I'd expect rootsquash to guarantee that new device > nodes can't be created from the network. Cc'ing random people from the > git log for include/linux/capability.h in hopes they can help. Yeah it seems reasonable. If it is, then does that mean that we also need CAP_SYS_ADMIN (to write selinux labels) and CAP_SETFCAP (to set file capabilities) as well? -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists