On Sun, 27 Dec 2009 16:06:10 -0600
"Serge E. Hallyn" <serue@xxxxxxxxxx> wrote:
> Quoting Mike Kazantsev (mk.fraggod@xxxxxxxxx):
...
> > CAP_DAC_READ_SEARCH seem to be well-suited and sufficient for the
> > task, according to docs:
> >
> > Bypass file read permission checks and directory read and execute
> > permission checks.
> >
> > I can see it bypassing directory checks, but it fails to bypass file
> > permission check.
...
>
> To be sure, are you saying that you've tested with CAP_DAC_OVERRIDE
> and that works? Are you running with selinux enforcing?
>
> Note my own test on 2.6.33-rc2-00007-g85d1bb6 succeeds...
>
Basically, that's what I'm seeing:
# uname -a
Linux alpharius 2.6.32.2-fg.minion32 #1 SMP Mon Dec 28 09:52:53 YEKT
2009 i686 Genuine Intel(R) CPU T2600 @ 2.16GHz GenuineIntel GNU/Linux
# gcc test.c -lcap-ng -o /test
# setcap 'cap_dac_read_search=ep' /test
# getcap /test
test = cap_dac_read_search+ep
# touch /root/test{1,2}
# chmod 600 /root/test1
# chmod 644 /root/test2
# ls -ld /root/{,test{1,2}}
drwx------ 21 root root 4.0K Dec 28 09:21 /root/
-rw------- 1 600 root 0 Dec 28 09:21 /root/test1
-rw-r--r-- 1 644 root 0 Dec 28 09:21 /root/test2
# su -s /bin/zsh nobody
% ls -ld /root/{,test{1,2}}
ls: cannot access /root/test1: Permission denied
ls: cannot access /root/test2: Permission denied
drwx------ 21 root root 4.0K Dec 28 09:21 /root/
% /sbin/getcap /test
/test = cap_dac_read_search+ep
% /test /root/test1
Capability: 1, error: Permission denied
% /test /root/test2
Capability: 1,
% exit
# setcap 'cap_dac_override=ep' /test
# su -s /bin/zsh nobody
% /sbin/getcap /test
/test = cap_dac_override+ep
% /test /root/test1
Capability: 0,
% /test /root/test2
Capability: 0,
Guess your post means that it's not a normal behavior and should work
as documented in capabilities(7).
No SELinux here, just plain 2.6.32.2 kernel on a KVM machine, 2.6.32.1
yields the same result.
Filesystem is ext4, acl support is compiled in, but not enabled.
I'm checking out git kernel tree now to test with 2.6.33 and see if I
can get it working, and cherry-pick a patch from there, thanks for the
suggestion.
--
Mike Kazantsev // fraggod.net
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
