bugutil-vserver - Bugs: bug #6180, change/show capabilites by PID

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #6180: change/show capabilites by PID

Submitted by:  None
Submitted on:  Sun 26 Oct 2003 10:16:51 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Wont Fix
Privacy: PublicAssigned to: None
Open/Closed: ClosedComponent Version: None
Release: 

Thu 30 Oct 2003 04:53:31 AM UTC, comment #4:

Hmm. Well, thanks for the suggestion, but ...
these tools are old. They're missing 'obvious' flags,
like --help. They have no man pages. And getpcaps
prints the results in some totally cryptic form.

For example:
/bin/sh
ps ax |grep sh
27729 pts/1 S 0:00 sh

getpcaps 27729
Capabilities for `27729': =ep cap_setpcap-ep
chcontext --secure /bin/sh
New security context is 13
ps ax |grep sh
27789 pts/1 S 0:00 /bin/sh
getpcaps 27789
Capabilities for `27789': = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_net_bind_service,cap_sys_chroot,cap_sys_ptrace,cap_sys_tty_config,cap_lease+ep

I think this is correct, but its very confusing to figure
this out. So I'd like to see a set of tools that are
simple enough, documented enough, etc. to help verify
that chcontext actually worked correctly.

Anonymous
Thu 30 Oct 2003 04:22:19 AM UTC, comment #3:

dohh

Anonymous
Thu 30 Oct 2003 02:06:02 AM UTC, comment #2:

IMO, util-vserver is the wrong place for such a functionality. The capabilities which are set by the shipped tools are upper-bounds, which can be lowered (but not increased) by other tools.

Such tools are e.g. 'getpcaps' and 'setpcaps' from the 'libcap' package which are having the functionality desired by you.

Therefore, I am closing it as WONTFIX.

Enrico Scholz <ensc>
Project Administrator
Sun 26 Oct 2003 10:17:33 PM UTC, comment #1:

p.s. I'm <linas@linas.org>

Anonymous
Sun 26 Oct 2003 10:16:51 PM UTC, original submission:

I'd like to have a simple command-line tool to change/show
process capabilites based on PID. Currntly I can
'cat /proc/PID/status' to view capabilites to view them
but the format is cryptic. There is no way to take away
capabilites from an already-running process, which I think would be useful (although I also understand that some people might argue against this as 'false-hope security')

p.s. I planned to add to the feature request list, but couldn't access that from this website.

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Thu 30 Oct 2003 02:06:02 AM UTCenscStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)

Back to the top


Powered by Savane 3.1-cleanup1