On Fri, 2009-03-13 at 14:00 -0500, Serge E. Hallyn wrote: > Quoting Igor Zhbanov (izh1979@xxxxxxxxx): > > But ordinary users can't create devices. It seems to me that in time > > of implementation of capabilities in kernel 2.4, capabilities related > > to filesystem was added first. And mark for them contains all above in > > header file. And when CAP_MKNOD was added later, author just forget to > > update mask. > > > > If mask was designed to drop all filesystem related capabilities, then > > it must be expanded, because ordinary users cannot create devices etc. > > I think you thought Bruce was saying we shouldn't change the set of > capabilities, but he was just asking exactly what changes Michael was > interested in. > > Igor, thanks for finding this. I never got your original message. Do > you have a patdch to add the two capabilities? Do you think the > other two I mentioned (CAP_SYS_ADMIN and CAP_SETFCAP) need to be > added too? > > I've added Andrew Morgan, LSM and SELinux mailing lists to get another > opinion about adding those two. In particular, we'd be adding them > to the fs_masks becuase CAP_SYS_ADMIN lets you change the selinux > label, and CAP_SETFCAP lets you change the file capabilities. I'd be inclined against adding CAP_SYS_ADMIN to the mask; note that it is only checked for setting SELinux security contexts (or more broadly any attributes in the security namespace) when SELinux is disabled. In the SELinux-enabled case, we are checking SELinux-specific permissions when setting the SELinux attributes, whether on the client or the server. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
