[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-security-module
Subject:    Re: [PATCH] Implement file posix capabilities
From:       Casey Schaufler <casey () schaufler-ca ! com>
Date:       2007-01-24 20:24:18
Message-ID: 239813.31714.qm () web36606 ! mail ! mud ! yahoo ! com
[Download RAW message or body]


--- Bill O'Donnell <billodo@sgi.com> wrote:

> ... That said, can one expect, through
> the use of these enhanced capabilities,
> to be able to add some finer grain 
> capabilities based on a specific userid?

POSIX capabilities are explictly disjoint from
userids in the kernel, and this is by design.
You could provide limited capability sets to
users at the application layer.

> In Chris' ping example,
> the suid is removed from /bin/ping to restrict it to
> root, and a 
> capability added to allow any user to execute it. 
> Can that example
> be extended to make it so only a _particular_ user
> can execute it?

Give the file the capability and set an
ACL that allows only that user execute access.

> I realize with SELinux, one could achieve the goal,
> but as a stopgap,
> can capabilities be used to get there?

Certainly, as above.

> Thanks,
> Bill
> 
> -- 
> Bill O'Donnell
> SGI

Have a look in /etc/irix.cap on a Trix box
some time. I suspect there might be one in
your facility.



Casey Schaufler
casey@schaufler-ca.com
-
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]