CAP_LINUX_IMMUTABLE question

Hi there

I am currently trying to tie down the capability bounding set on one of my servers. CAP_SYS_RAWIO and CAP_SYS_MODULE have been a great success (although dropping CAP_SYS_RAWIO seems to prevent reading /proc/sys/kernel/cap-bound).

I now want to drop CAP_LINUX_IMMUTABLE, and have (I think) done that. However, it seems to make no difference to my ability to set or clear the immutable attribute. I tried this on ext2 and ext3 filesystems just to be on the safe side.

[root@henry /boot]# lcap CAP_LINUX_IMMUTABLE [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp ---i--------- ./vmlinux-2.4.2-2smp [root@henry /boot]# chattr -i ./vmlinux-2.4.2-2smp [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp ------------- ./vmlinux-2.4.2-2smp [root@henry /boot]# chattr +i ./vmlinux-2.4.2-2smp [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp ---i--------- ./vmlinux-2.4.2-2smp

I thought that giving up CAP_SYS_RAWIO may have forfeited my ability to drop any further caps, so I rebooted and dropped CAP_SYS_MODULE and CAP_LINUX_IMMUTABLE first, just to be on the safe side. This made no visible difference.

Am I doing anything obviously dumb?

Sean

The code that _should_ check this is fs/ext[23]/ioctl.c:EXT[23]_IOC_SETFLAGS, so you may want to add some debugging there, to see:
1) if you really have dropped CAP_LINUX_IMMUTABLE
2) the logic of the checking is correct

Cheers, Andreas

Andreas Dilger  \ "If a man ate a pound of pasta and a pound of antipasto,
                 \  would they cancel out, leaving him still hungry?"
http://www-mddsp.enel.ucalgary.ca/People/adilger/               -- Dogbert