Re: Possible problem in linux file posix capabilities

2008-02-18 Thread Serge E. Hallyn
Quoting Casey Schaufler ([EMAIL PROTECTED]): > > --- "Serge E. Hallyn" <[EMAIL PROTECTED]> wrote: > > > > > > > Two quick fixes for you right now (apart from the one you've already > > got :) would be > > > > 1. give wireshark cap_kill, by doing something like > > > >

Re: Possible problem in linux file posix capabilities

2008-02-18 Thread Serge E. Hallyn
Quoting Casey Schaufler ([EMAIL PROTECTED]): --- Serge E. Hallyn [EMAIL PROTECTED] wrote: Two quick fixes for you right now (apart from the one you've already got :) would be 1. give wireshark cap_kill, by doing something like capset cap_kill=ep

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Casey Schaufler
--- "Serge E. Hallyn" <[EMAIL PROTECTED]> wrote: > > > Two quick fixes for you right now (apart from the one you've already > got :) would be > > 1. give wireshark cap_kill, by doing something like > > capset cap_kill=ep /bin/wireshark > > 2. compile a kernel

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Andrew G. Morgan
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: | Signed-off-by: Serge E. Hallyn <[EMAIL PROTECTED]> | --- | security/commoncap.c |2 +- | 1 files changed, 1 insertions(+), 1 deletions(-) | | diff --git a/security/commoncap.c b/security/commoncap.c | index

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Serge E. Hallyn
Quoting Andrew G. Morgan ([EMAIL PROTECTED]): > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Serge E. Hallyn wrote: > | Andrew, this pretty much was bound to happen... we need to figure out > | what our approach here should be. My preference is still to allow > | signals when

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Andrew G. Morgan
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: | Andrew, this pretty much was bound to happen... we need to figure out | what our approach here should be. My preference is still to allow | signals when p->uid==current->uid so long as !SECURE_NOROOT. Then as | people

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Serge E. Hallyn
Quoting [EMAIL PROTECTED] ([EMAIL PROTECTED]): > Hello, > I'm not sure it is you the right person to contact. > I tried to run latest normal user wireshark with SUID dumpcap without success > under linux-2.6.24.2. After looking around it seems to be related to the file > in the kernel

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Serge E. Hallyn
Quoting [EMAIL PROTECTED] ([EMAIL PROTECTED]): Hello, I'm not sure it is you the right person to contact. I tried to run latest normal user wireshark with SUID dumpcap without success under linux-2.6.24.2. After looking around it seems to be related to the file in the kernel

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Andrew G. Morgan
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: | Andrew, this pretty much was bound to happen... we need to figure out | what our approach here should be. My preference is still to allow | signals when p-uid==current-uid so long as !SECURE_NOROOT. Then as | people start

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Serge E. Hallyn
Quoting Andrew G. Morgan ([EMAIL PROTECTED]): -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: | Andrew, this pretty much was bound to happen... we need to figure out | what our approach here should be. My preference is still to allow | signals when p-uid==current-uid

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Andrew G. Morgan
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: | Signed-off-by: Serge E. Hallyn [EMAIL PROTECTED] | --- | security/commoncap.c |2 +- | 1 files changed, 1 insertions(+), 1 deletions(-) | | diff --git a/security/commoncap.c b/security/commoncap.c | index

Re: Possible problem in linux file posix capabilities

2008-02-17 Thread Casey Schaufler
--- Serge E. Hallyn [EMAIL PROTECTED] wrote: Two quick fixes for you right now (apart from the one you've already got :) would be 1. give wireshark cap_kill, by doing something like capset cap_kill=ep /bin/wireshark 2. compile a kernel with