aboutsummaryrefslogtreecommitdiff
path: root/libbb
diff options
context:
space:
mode:
authorPatrick Steinhardt <ps@pks.im>2017-07-07 01:59:45 +0200
committerDenys Vlasenko <vda.linux@googlemail.com>2017-07-07 01:59:45 +0200
commit0f49f6f9265ed339e69868708e4d303592a70507 (patch)
tree2c1618ae18f6ac9a2e532d8bda56a722bd276dd2 /libbb
parent5e0987405cb966ec041db96b75169bb992fb710e (diff)
downloadbusybox-0f49f6f9265ed339e69868708e4d303592a70507.tar.gz
setpriv: allow modifying inheritable caps
The main use case of setpriv is to modify the current state of privileges available to the calling process and spawn a new executable with the modified, new state. Next to the already supported case of modifying the no-new-privs flag, util-linux also supports to modify capability sets. This commit introduces to add or drop capabilities from the set of inheritable capabilities. Quoting from capabilities(7): This is a set of capabilities preserved across an execve(2). Inheritable capabilities remain inheritable when executing any program, and inheritable capabilities are added to the permitted set when executing a program that has the corresponding bits set in the file inheritable set. As such, inheritable capabilities enable executing files with certain privileges if the file itself has these privileges set. Note though that inheritable capabilities are dropped across execve when running as a non-root user. function old new delta getcaps - 237 +237 setpriv_main 1129 1246 +117 .rodata 146198 146307 +109 static.setpriv_longopts 29 40 +11 packed_usage 32107 32092 -15 Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'libbb')
0 files changed, 0 insertions, 0 deletions