Debian Bug report logs - #439873
libcap-bin: sucap not useful on 2.6 kernels?

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: submit@bugs.debian.org

Subject: libcap-bin: sucap not useful on 2.6 kernels?

Date: Mon, 27 Aug 2007 23:29:48 -0700

Package: libcap-bin
Version: 1:1.10-14
Severity: important

Hi Michael,

I've been trying to evaluate the status of the POSIX capability patch that's
included in the Debian PAM package in relation to bug #153157, and I'm
having some serious doubts that the libcap-bin programs actually work:

$ su
Password: 
# /sbin/getpcaps $$
Capabilities for `13995': =ep cap_setpcap-ep
# sucap vorlon vorlon /bin/bash
Caps: =ep cap_setpcap-ep
Caps: =
[debug] uid:1000, real uid:1000
sucaps: capsetp: Operation not permitted
sucap: child did not exit cleanly.
#

Is this related to the fact that all of these processes seem to have an
empty set of inheritable capabilities?  Is it a general problem of
capabilities support in recent kernels?

From what I see, if I can't set an inheritable capability, capability
support in pam_limits isn't much use and should be dropped.

Thanks,
-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Message #10 received at 439873@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: 439873@bugs.debian.org

Subject: Re: libcap-bin: sucap not useful on 2.6 kernels?

Date: Mon, 27 Aug 2007 23:56:20 -0700

Here's a different attempt:

# execcap "all+eip cap_setpcap-eip" /bin/bash
# /sbin/getpcaps $$
Capabilities for `15044': =eip cap_setpcap-eip
# sucap vorlon vorlon /bin/bash
Caps: =eip cap_setpcap-eip
Caps: =i cap_setpcap-i
[debug] uid:1000, real uid:1000
sucaps: capsetp: Operation not permitted
sucap: child did not exit cleanly.
#

So as root I can manually spawn a shell that has the inheritable bits set,
but when running sucap, *only* the inheritable bits are copied, the
effective/permitted bits are not, so trying to set them in the child process
fails.  Looks broken to me?

Thanks,
-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Message #15 received at 439873-done@bugs.debian.org (full text, mbox, reply):

From: Torsten Werner <twerner@debian.org>

To: 439873-done@bugs.debian.org

Subject: Bug #439873: libcap-bin: sucap not useful on 2.6 kernels?

Date: Sun, 22 Mar 2009 21:13:14 +0100

Hi,

the binaries mentioned in the bug report are obsolete and no longer
shipped in libcap2. The old package libcap will be removed soon from
Debian unstable.

Cheers,
Torsten

Send a report that this bug log contains spam.