Thank you for the answer. I was reading the mails on lsm, but it wasn't obvious to me, that right now libcap-2.0 is for 64-bit capabilities which are currently only in -mm.
I personally find the situation right now a little bit unfortunate. During holidays - I can imagine - quite a few people like to try new features in anticipating the 2.6 24 release. Libcap-2.x is for 64-bit caps which is now only in 2.6.24-rc5-mm1 and libcap-1.0 which works for 2.6.24-rc5/6 is not accessible. BTW your article got slashdotted: http://linux.slashdot.org/article.pl?sid=07/12/22/209212 ... and have a nice christmas Chris On Sun, 23 Dec 2007 17:24:50 -0600 [EMAIL PROTECTED] wrote: > libcap-2.0 is for 64-bit capabilities which are currently > only in -mm. So switch your kernel to 2.6.24-rc5-mm1, or > use the latest libcap-1.x. > > I actually confused myself the same way two weeks ago or > so :) > > It almost seems worth it to have libcap-2.x use 32-bit file > capabilities so long as no capabilities above 31 need to > be set, just to avoid gratuitous headaches until 2.6.25. > Andrew, what do you think? > > -serge > > Quoting Chris Friedhoff ([EMAIL PROTECTED]): > > Hello, > > > > I'm (still) updating my documentation on > > http://www.friedhoff.org/fscaps.html. > > > > I just learned, that KaiGai has taken his userspace tools offline and > > Andrews tools are updated and are now the prefered one. > > > > But I have a problem ... > > > > I tried it with 2.6.24-rc5 and 2.6.24-rc6 and with libcap 2.00, 2.01, > > 20071203 (newest in git) on an 32 bit System > > > > setcap sets according to attr the capability attribute with 20 byte, > > whereby setfcaps sets a 12 byte value. > > getcap can read the value set by setfcaps but not by setcap. > > Executing a by setcap "capability enabled" binary gives an "Invalid argumet" > > error. > > What am I missing? > > > > Thanks > > Chris > > > > > > Commands executed on a shell: > > ----------------------------- > > > > When I try to set a capability: > > ------------------------------- > > > > $ sudo libcap-2.01/progs/setcap cap_net_raw=ep ping > > $ echo $? > > 0 > > I get: > > $ attr -l ping > > Attribute "capability" has a 20 byte value for ping > > $ libcap-2.01/progs/getcap ping > > Failed to get capabilities for file `ping' (Invalid argument) > > ./ping localhost > > bash: ./ping: Invalid argument > > > > But when I use KaiGai's tool: > > ----------------------------- > > > > $ sudo setfcaps -c cap_net_raw=p -e ping > > $ attr -l ping > > Attribute "capability" has a 12 byte value for ping > > $ libcap-2.01/progs/getcap ping > > $ ./ping localhost (works also) > > > > > > strace outputs: > > --------------- > > > > strace output without needed privileges > > --------------------------------------- > > > > $ ls -l libcap-2.01/progs/setcap > > -rwxr-xr-x 1 chris users 611672 Dec 23 14:02 libcap-2.01/progs/setcap > > $ > > $ strace libcap-2.01/progs/setcap cap_net_raw=ep ping > > execve("libcap-2.01/progs/setcap", ["libcap-2.01/progs/setcap", > > "cap_net_raw=ep", "ping"], [/* 55 vars */]) = 0 > > uname({sys="Linux", node="apollo", ...}) = 0 > > brk(0) = 0x80ca000 > > brk(0x80cacb0) = 0x80cacb0 > > set_thread_area({entry_number:-1 -> 6, base_addr:0x80ca830, limit:1048575, > > seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, > > seg_not_present:0, useable:1}) = 0 > > brk(0x80ebcb0) = 0x80ebcb0 > > brk(0x80ec000) = 0x80ec000 > > capget(0x19980330, 0, NULL) = -1 EINVAL (Invalid argument) > > capget(0x19980330, 0, {0, 0, 0}) = 0 > > capset(0x19980330, 0, {0x80000000 /* CAP_??? */, 0, 0}) = -1 EPERM > > (Operation not permitted) > > dup(2) = 3 > > fcntl64(3, F_GETFL) = 0x2 (flags O_RDWR) > > fstat64(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 > > mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = > > 0xb7f14000 > > _llseek(3, 0, 0xbff51724, SEEK_CUR) = -1 ESPIPE (Illegal seek) > > write(3, "unable to set CAP_SETFCAP effect"..., 72unable to set CAP_SETFCAP > > effective capability: Operation not permitted > > ) = 72 > > close(3) = 0 > > munmap(0xb7f14000, 4096) = 0 > > brk(0x80eb000) = 0x80eb000 > > exit_group(1) = ? > > Process 3718 detached > > > > > > strace output with root owned suid bit binary > > --------------------------------------------- > > -rwsr-xr-x 1 root root 611672 Dec 23 14:02 libcap-2.01/progs/setcap* > > $ > > $ strace libcap-2.01/progs/setcap cap_net_raw=ep ping > > execve("libcap-2.01/progs/setcap", ["libcap-2.01/progs/setcap", > > "cap_net_raw=ep", "ping"], [/* 55 vars */]) = 0 > > uname({sys="Linux", node="apollo", ...}) = 0 > > brk(0) = 0x80ca000 > > brk(0x80cacb0) = 0x80cacb0 > > set_thread_area({entry_number:-1 -> 6, base_addr:0x80ca830, limit:1048575, > > seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, > > seg_not_present:0, useable:1}) = 0 > > brk(0x80ebcb0) = 0x80ebcb0 > > brk(0x80ec000) = 0x80ec000 > > access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or > > directory) > > fcntl64(0, F_GETFD) = 0 > > fcntl64(1, F_GETFD) = 0 > > fcntl64(2, F_GETFD) = 0 > > capget(0x19980330, 0, NULL) = -1 EINVAL (Invalid argument) > > capget(0x19980330, 0, {0, 0, 0}) = 0 > > capset(0x19980330, 0, {0x80000000 /* CAP_??? */, 0, 0}) = -1 EPERM > > (Operation not permitted) > > dup(2) = 3 > > fcntl64(3, F_GETFL) = 0x2 (flags O_RDWR) > > fstat64(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 > > mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = > > 0xb7f99000 > > _llseek(3, 0, 0xbf9b0984, SEEK_CUR) = -1 ESPIPE (Illegal seek) > > write(3, "unable to set CAP_SETFCAP effect"..., 72unable to set CAP_SETFCAP > > effective capability: Operation not permitted > > ) = 72 > > close(3) = 0 > > munmap(0xb7f99000, 4096) = 0 > > brk(0x80eb000) = 0x80eb000 > > exit_group(1) = ? > > Process 3724 detached > > > > > > and the same as root > > -------------------- > > strace libcap-2.01/progs/setcap cap_net_raw=ep ping > > execve("libcap-2.01/progs/setcap", ["libcap-2.01/progs/setcap", > > "cap_net_raw=ep", "ping"], [/* 55 vars */]) = 0 > > uname({sys="Linux", node="apollo", ...}) = 0 > > brk(0) = 0x80ca000 > > brk(0x80cacb0) = 0x80cacb0 > > set_thread_area({entry_number:-1 -> 6, base_addr:0x80ca830, limit:1048575, > > seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, > > seg_not_present:0, useable:1}) = 0 > > brk(0x80ebcb0) = 0x80ebcb0 > > brk(0x80ec000) = 0x80ec000 > > capget(0x19980330, 0, NULL) = -1 EINVAL (Invalid argument) > > capget(0x19980330, 0, > > {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_FSETID|CAP_KILL|CAP_SETGID|CAP_SETUID|CAP_SETPCAP|CAP_LINUX_IMMUTABLE|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_ADMIN|CAP_NET_RAW|CAP_IPC_LOCK|CAP_IPC_OWNER|CAP_SYS_MODULE|CAP_SYS_RAWIO|CAP_SYS_CHROOT|CAP_SYS_PTRACE|CAP_SYS_PACCT|CAP_SYS_ADMIN|CAP_SYS_BOOT|CAP_SYS_NICE|CAP_SYS_RESOURCE|CAP_SYS_TIME|CAP_SYS_TTY_CONFIG|0xf8000000, > > > > CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_FSETID|CAP_KILL|CAP_SETGID|CAP_SETUID|CAP_SETPCAP|CAP_LINUX_IMMUTABLE|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_ADMIN|CAP_NET_RAW|CAP_IPC_LOCK|CAP_IPC_OWNER|CAP_SYS_MODULE|CAP_SYS_RAWIO|CAP_SYS_CHROOT|CAP_SYS_PTRACE|CAP_SYS_PACCT|CAP_SYS_ADMIN|CAP_SYS_BOOT|CAP_SYS_NICE|CAP_SYS_RESOURCE|CAP_SYS_TIME|CAP_SYS_TTY_CONFIG|0xf8000000, > > 0}) = 0 > > capset(0x19980330, 0, > > {CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_FSETID|CAP_KILL|CAP_SETGID|CAP_SETUID|CAP_SETPCAP|CAP_LINUX_IMMUTABLE|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_ADMIN|CAP_NET_RAW|CAP_IPC_LOCK|CAP_IPC_OWNER|CAP_SYS_MODULE|CAP_SYS_RAWIO|CAP_SYS_CHROOT|CAP_SYS_PTRACE|CAP_SYS_PACCT|CAP_SYS_ADMIN|CAP_SYS_BOOT|CAP_SYS_NICE|CAP_SYS_RESOURCE|CAP_SYS_TIME|CAP_SYS_TTY_CONFIG|0xf8000000, > > > > CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_FSETID|CAP_KILL|CAP_SETGID|CAP_SETUID|CAP_SETPCAP|CAP_LINUX_IMMUTABLE|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_ADMIN|CAP_NET_RAW|CAP_IPC_LOCK|CAP_IPC_OWNER|CAP_SYS_MODULE|CAP_SYS_RAWIO|CAP_SYS_CHROOT|CAP_SYS_PTRACE|CAP_SYS_PACCT|CAP_SYS_ADMIN|CAP_SYS_BOOT|CAP_SYS_NICE|CAP_SYS_RESOURCE|CAP_SYS_TIME|CAP_SYS_TTY_CONFIG|0xf8000000, > > 0}) = 0 > > capget(0x19980330, 0, NULL) = -1 EINVAL (Invalid argument) > > setxattr("ping", "security.capability", "\x01\x00\x00\x01\x00 > > \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1aW\xe4\xbf", 20, 0) = 0 > > exit_group(0) = ? > > Process 3727 detached > > > > > > > > > > > > -------------------- > > Chris Friedhoff > > [EMAIL PROTECTED] > > - > > To unsubscribe from this list: send the line "unsubscribe > > linux-security-module" in > > the body of a message to [EMAIL PROTECTED] > > More majordomo info at http://vger.kernel.org/majordomo-info.html -------------------- Chris Friedhoff [EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
