Quoting Andrew Morgan ([EMAIL PROTECTED]): > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > > Serge E. Hallyn wrote: > > Quoting Chris Friedhoff ([EMAIL PROTECTED]): > >> Hello, > >> > >> in updating the documentation > >> http://www.friedhoff.org/posixfilecaps.html I discovered that it is > >> possible to give directories through setcap also the extended attribute > >> capability and therefor grant them capabilities. > >> Is this is intended or maybe not ? If it's intended, what is the benefit > >> of this? > > > > I'm assuming it's unintended - or rather it's harmless but has no use - > > but will let Andrew respond since he may have some cool idea i haven't > > thought of. > > This is not intended behavior. It should be fixed (aka such support > removed). Capabilities should only be available on executable files - > not directories, symlinks or anything else...
So do you plan on returning an error when libcap is asked to put file capabilities on a directory, or were you saying you think it should be fixed in the kernel? If the latter I half-heartedly disagree - the capabilities are just xattrs. We can have the capability module do a check, but of course a non-capability kernel won't have those checks anyway. thanks, -serge - To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
