Re: [PATCH iproute2 v1] Drop capabilities if not running ip exec vrf with libcap

On Tue, 27 Mar 2018 18:48:55 +0100 Luca Boccassi wrote: > ip vrf exec requires root or CAP_NET_ADMIN, CAP_SYS_ADMIN and > CAP_DAC_OVERRIDE. It is not possible to run unprivileged commands like > ping as non-root or non-cap-enabled due to this requirement. > To allow users and administrators to sa

[PATCH iproute2 v1] Drop capabilities if not running ip exec vrf with libcap

ip vrf exec requires root or CAP_NET_ADMIN, CAP_SYS_ADMIN and CAP_DAC_OVERRIDE. It is not possible to run unprivileged commands like ping as non-root or non-cap-enabled due to this requirement. To allow users and administrators to safely add the required capabilities to the binary, drop all capabil