On Thu, 2009-02-05 at 11:08 -0600, Xavier Toth wrote: > I've set the capabilities on a script that runs some python code with > auditing calls in it but I'm not getting audit records written to the > audit log. From what I've read I thought the +i would all the > capability to be inherited across execve but this doesn't appear to be > the case. Can anyone help me understand what's going wrong here? Is > there a way in the python code to get the capabilities to see if > indeed cap_audit_write was inherited? Linux doesn't honor setuid on scripts, and file capabilities are supposed to have the same behavior (they didn't for a while due to an oversight, but that was corrected). You need an executable wrapper program that invokes the script, like: http://oss.tresys.com/projects/clip/browser/trunk/RHEL5.2/scripts/wrappers/wrapper.c -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
