From: "Daniel Xu" <dxu@dxuuu.xyz>
To: viro@zeniv.linux.org.uk, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Odd interaction with file capabilities and procfs files
Date: Tue, 18 Oct 2022 18:42:04 -0600 [thread overview]
Message-ID: <f1e63e54-d88d-4b69-86f1-c0b4a0fd8035@app.fastmail.com> (raw)
Hi,
(Going off get_maintainers.pl for fs/namei.c here)
I'm seeing some weird interactions with file capabilities and S_IRUSR
procfs files. Best I can tell it doesn't occur with real files on my btrfs
home partition.
Test program:
#include <fcntl.h>
#include <stdio.h>
int main()
{
int fd = open("/proc/self/auxv", O_RDONLY);
if (fd < 0) {
perror("open");
return 1;
}
printf("ok\n");
return 0;
}
Steps to reproduce:
$ gcc main.c
$ ./a.out
ok
$ sudo setcap "cap_net_admin,cap_sys_admin+p" a.out
$ ./a.out
open: Permission denied
It's not obvious why this happens, even after spending a few hours
going through the standard documentation and kernel code. It's
intuitively odd b/c you'd think adding capabilities to the permitted
set wouldn't affect functionality.
Best I could tell the -EACCES error occurs in the fallthrough codepath
inside generic_permission().
Sorry if this is something dumb or obvious.
Thanks,
Daniel
next reply other threads:[~2022-10-19 0:42 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-19 0:42 Daniel Xu [this message]
2022-10-19 13:22 ` Odd interaction with file capabilities and procfs files Christian Brauner
2022-10-19 21:42 ` Daniel Xu
2022-10-20 7:44 ` Christian Brauner
2022-10-20 21:35 ` Daniel Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f1e63e54-d88d-4b69-86f1-c0b4a0fd8035@app.fastmail.com \
--to=dxu@dxuuu.xyz \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).