added code to export CAP_LAST_CAP in /proc/sys/kernel modeled after ngroups_max
Subsystems (2)
PATCH 1/1 added code to export CAP_LAST_CAP in /proc/sys/kernel modeled after ngroups_max
In response to a request by the Linux Plumbers about getting CAP_LAST_CAP exposed somehow, I talked to Lennart Poettering briefly and went ahead and added cap_last_cap to /proc/sys/kernel in a similar fashion as ngroups_max is exported. The patch is simple and just adds another struct to the array of exported values in sysctl.c.
--- kernel/sysctl.c | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-)
kernel/sysctl.c +9 -0
@@ -57,6 +57,7 @@#include <linux/pipe_fs_i.h> #include <linux/oom.h> #include <linux/kmod.h> +#include <linux/capability.h> #include <asm/uaccess.h> #include <asm/processor.h>
@@ -134,6 +135,7 @@ static int minolduid;static int min_percpu_pagelist_fract =8 ;static int ngroups_max =NGROUPS_MAX ; +static int cap_last_cap =CAP_LAST_CAP ;#ifdef CONFIG_INOTIFY_USER #include <linux/inotify.h>
@@ -730,6 +732,13 @@ static struct ctl_table kern_table[] = { .mode = 0444, .proc_handler = proc_dointvec, }, + { + .procname = "cap_last_cap", + .data = &cap_last_cap, + .maxlen = sizeof(int), + .mode = 0444, + .proc_handler = proc_dointvec, + }, #if defined(CONFIG_LOCKUP_DETECTOR) { .procname = "watchdog",
Signature · 1 line
1.7.4.1
Quoted 2 lines · On Wed, 12 Oct 2011 15:56:34 -0700 Dan Ballard <[email protected]> wrote:
In response to a request by the Linux Plumbers about getting
CAP_LAST_CAPexposed somehow, I talked to Lennart Poettering briefly and went ahead and addedcap_last_capto/proc/sys/kernelin a similar fashion asngroups_maxis exported. The patch is simple and just adds another struct to the array of exported values insysctl.c.
The changelog should explain the reason for making this change, please. People aren't going to remember some vague email thread five years from now.
Also, please update the documentation. Documentation/sysctl/kernel.txt is a suitable place. Lots of things in kern_table[] are undocumented, but that's not a reason for the rest of us to suck as much as sched developers :)
PATCH 1/1 kernel/sysctl.c: Add cap_last_cap to /proc/sys/kernel
In reply to Dan BallardUserspace needs to know the highest valid capability of the running kernel, which right now cannot reliably be retrieved from the header files only. The fact that this value cannot be determined properly right now creates various problems for libraries compiled on newer header files which are run on older kernels. They assume capabilities are available which actually aren't.
Now the capability is exported in /proc/sys/kernel/cap_last_cap.
--- Documentation/sysctl/kernel.txt | 8 ++++++++ kernel/sysctl.c | 9 +++++++++ 2 files changed, 17 insertions(+), 0 deletions(-)
Documentation/sysctl/kernel.txt +8 -0
@@ -24,6 +24,7 @@ show up in /proc/sys/kernel: - bootloader_type [ X86 only ] - bootloader_version [ X86 only ] - callhome [ S390 only ] +- cap_last_cap - core_pattern - core_pipe_limit - core_uses_pid
@@ -155,6 +156,13 @@ on has a service contract with IBM. ============================================================== +cap_last_cap + +Highest valid capability of the running kernel. Exports +CAP_LAST_CAP from the kernel. + +============================================================== + core_pattern: core_pattern is used to specify a core dumpfile pattern name.
kernel/sysctl.c +9 -0
@@ -57,6 +57,7 @@#include <linux/pipe_fs_i.h> #include <linux/oom.h> #include <linux/kmod.h> +#include <linux/capability.h> #include <asm/uaccess.h> #include <asm/processor.h>
@@ -134,6 +135,7 @@ static int minolduid;static int min_percpu_pagelist_fract =8 ;static int ngroups_max =NGROUPS_MAX ; +static int cap_last_cap =CAP_LAST_CAP ;#ifdef CONFIG_INOTIFY_USER #include <linux/inotify.h>
@@ -730,6 +732,13 @@ static struct ctl_table kern_table[] = { .mode = 0444, .proc_handler = proc_dointvec, }, + { + .procname = "cap_last_cap", + .data = &cap_last_cap, + .maxlen = sizeof(int), + .mode = 0444, + .proc_handler = proc_dointvec, + }, #if defined(CONFIG_LOCKUP_DETECTOR) { .procname = "watchdog",
Signature · 1 line
1.7.2.5
Re: [PATCH 1/1] kernel/sysctl.c: Add cap_last_cap to /proc/sys/kernel
Quoted 6 lines · On Sat, 15 Oct 2011 07:50:05 -0700 Dan Ballard <[email protected]> wrote:
Userspace needs to know the highest valid capability of the running kernel, which right now cannot reliably be retrieved from the header files only. The fact that this value cannot be determined properly right now creates various problems for libraries compiled on newer header files which are run on older kernels. They assume capabilities are available which actually aren't.
Specfically, what libraries are we talking about here?
Quoted 1 line
Now the capability is exported in
/proc/sys/kernel/cap_last_cap.
Ever the optimist: is there any way in which we can avoid 0444 permissions on this?
Re: [PATCH 1/1] kernel/sysctl.c: Add cap_last_cap to /proc/sys/kernel
Quoted 4 lines · Andrew Morton
On Sat, 15 Oct 2011 07:50:05 -0700
Dan Ballard <[email protected]> wrote:
Quoted 8 lines
Quoted 6 lines
Userspace needs to know the highest valid capability of the running kernel, which right now cannot reliably be retrieved from the header files only. The fact that this value cannot be determined properly right now creates various problems for libraries compiled on newer header files which are run on older kernels. They assume capabilities are available which actually aren't.
Specfically, what libraries are we talking about here?
libcap-ng, for example. And we ran into the same problem with systemd too.
Quoted 5 lines
Quoted 2 lines
Now the capability is exported in
/proc/sys/kernel/cap_last_cap.Ever the optimist: is there any way in which we can avoid 0444 permissions on this?
Normal users should be able to query this value, and it's not a security problem if they do. Hence 0444 appears to be the right setting to me.
Lennart
Signature · 1 line
Lennart Poettering - Red Hat, Inc.