Hi Steve, > > Thanks foradding this. Another question that comes to my mind. Where do you > > have the GIT tree for libcap-ng so we can track the development? > > I've never needed to use git - so no git tree. The project has a home page > here: http://people.redhat.com/sgrubb/libcap-ng/ > and I announce package updates at freshmeat.net. The libcap-ng package is > stable and I would not have made a release yesterday if it weren't for needing > to a pc file. I don't forsee much development in libcap-ng unless there are > updates in the kernel that I need to take into account. IOW, all planned > features are complete and I'm not tracking any bugs. from a security point of it is nice if you have a source code repository with version tracking. Only thinking about your security team if something might happen :) > > > > I like to have capability dropping in bluetoothd, but I do wanna do it > > > > with a proper upstream project. > > > > > > one other thing I thought I would point out. The patch I sent can make it > > > easy to run the bluetooth daemon as non-root user. If we switch this > > > line: > > > capng_apply(CAPNG_SELECT_BOTH); > > > > > > to > > > > > > capng_change_id(uid, gid, CAPNG_DROP_SUPP_GRP | CAPNG_CLEAR_BOUNDING); > > > > > > then the job is easier. Of course you would likely need to fixup file > > > permissions in places, but in theory a non-root bluetooth daemon is > > > possible with a 1 line change in the patch. You would probably want to > > > add error handling and a way to specify the uid/gid, too. > > > > I am not really sold on the non-root daemon idea and there might be > > hidden problems where this will not work out. However I don't mind > > trying at some point, but there are other things to sort out first. We > > should postpone this for the 5.x series. > > Sure, I just wanted to point out that its a 1 line change in code if you ever > wanted to do this. > > > > Please re-send the original patch using pkg-config so I can go ahead an > > apply it. Even if Rawhide is not carrying the updated libcap-ng package. > > OK, as soon as I figure out pkg-config. M4 is easier. :) But the number of people who can read M4 getting less and less. I can read it, but then nobody else inside the team will have a real clue. Just send me a patch without the pkg-config magic and I can add that for you after I applied the patch. Regards Marcel -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
