Thu 30 Oct 2003 04:53:31 AM UTC, comment #4:
Hmm. Well, thanks for the suggestion, but ...
these tools are old. They're missing 'obvious' flags,
like --help. They have no man pages. And getpcaps
prints the results in some totally cryptic form.
For example:
/bin/sh
ps ax |grep sh
27729 pts/1 S 0:00 sh
getpcaps 27729
Capabilities for `27729': =ep cap_setpcap-ep
chcontext --secure /bin/sh
New security context is 13
ps ax |grep sh
27789 pts/1 S 0:00 /bin/sh
getpcaps 27789
Capabilities for `27789': = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_net_bind_service,cap_sys_chroot,cap_sys_ptrace,cap_sys_tty_config,cap_lease+ep
I think this is correct, but its very confusing to figure
this out. So I'd like to see a set of tools that are
simple enough, documented enough, etc. to help verify
that chcontext actually worked correctly.
|
Thu 30 Oct 2003 02:06:02 AM UTC, comment #2:
IMO, util-vserver is the wrong place for such a functionality. The capabilities which are set by the shipped tools are upper-bounds, which can be lowered (but not increased) by other tools.
Such tools are e.g. 'getpcaps' and 'setpcaps' from the 'libcap' package which are having the functionality desired by you.
Therefore, I am closing it as WONTFIX.
|
Sun 26 Oct 2003 10:16:51 PM UTC, original submission:
I'd like to have a simple command-line tool to change/show
process capabilites based on PID. Currntly I can
'cat /proc/PID/status' to view capabilites to view them
but the format is cryptic. There is no way to take away
capabilites from an already-running process, which I think would be useful (although I also understand that some people might argue against this as 'false-hope security')
p.s. I planned to add to the feature request list, but couldn't access that from this website.
|