22.04.2024 22:53, Stefan Metzmacher пишет:
I'm wondering if it would be better to capture the whole cred structure.
Similar to io_register_personality(), which uses get_current_cred().
Only using uid and gid, won't reflect any group memberships or
capabilities...
I ended up posting v3 where the
group memberships are added but
the rest, including capabilities, is
omitted to avoid security risks.
Does adding just a groupinfo to the
set of overridden members (which is
now: fsuid, fsgid and group_info) address
your concern?
I really think that raising caps is far
out of the scope for my approach, which
aims to be safe and simple. Someone
else can do that later, if need be.
