* [Bug 216667] New: Self-contradictory description of inheritable capability set
@ 2022-11-06 3:04 bugzilla-daemon
2023-05-19 2:11 ` [Bug 216667] " bugzilla-daemon
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: bugzilla-daemon @ 2022-11-06 3:04 UTC (permalink / raw)
To: linux-man
https://bugzilla.kernel.org/show_bug.cgi?id=216667
Bug ID: 216667
Summary: Self-contradictory description of inheritable
capability set
Product: Documentation
Version: unspecified
Hardware: All
OS: Linux
Status: NEW
Severity: normal
Priority: P1
Component: man-pages
Assignee: documentation_man-pages@kernel-bugs.osdl.org
Reporter: robryk@gmail.com
Regression: No
man capabilities says about the inheritable capset of a process:
> This is a set of capabilities preserved across an execve(2). Inheritable
> capabilities remain inheritable when executing any program, (...)
I understand this to mean that any capability in the inheritable set will stay
inheritable across an execve (i.e. the inheritable set will not shrink across
execve).
The same manpage says in the next paragraph:
> Because inheritable capabilities are not generally preserved across execve(2)
> when running as a non-root user (...)
This seems to say the exact opposite of how I read the previous paragraph.
I am probably misunderstanding something basic here, but I am unlikely to be
the only person who does so, so I think it bears making this part clearer.
(When I try to look at the rest of the manpage to get more clarity, I fail:
- the section that describes capability transformations across execve() seems
to say that inheritable capset stays constant,
- the description of ambient capabilities implies that inheritable
capabilities differ from ambient insofar ambient ones are more "durable" across
execve().)
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching the assignee of the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 216667] Self-contradictory description of inheritable capability set
2022-11-06 3:04 [Bug 216667] New: Self-contradictory description of inheritable capability set bugzilla-daemon
@ 2023-05-19 2:11 ` bugzilla-daemon
2023-05-19 2:28 ` bugzilla-daemon
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: bugzilla-daemon @ 2023-05-19 2:11 UTC (permalink / raw)
To: linux-man
https://bugzilla.kernel.org/show_bug.cgi?id=216667
Monthero Ronald (rhmcruiser@gmail.com) changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rhmcruiser@gmail.com
--- Comment #1 from Monthero Ronald (rhmcruiser@gmail.com) ---
It's to make a distinction between a root user and non root user for the
process. The first part of the paragraph below is for root user and the later
part is for execve run as non root user. And on other hand applications ( using
execve) that run with few elevated capability flags can use ambient
capabilities. The statement you quoted from man page - Inheritable section
below:
---
Inheritable
This is a set of capabilities preserved across an execve(2).
Inheritable capabilities remain inheritable when executing
any program, and inheritable capabilities are added to the
permitted set when executing a program that has the correspond‐
ing bits set in the file inheritable set.
Because inheritable capabilities are not generally preserved
across execve(2) when running as a non-root user, applications
that wish to run helper programs with elevated capabilities
should consider using ambient capabilities, described below.
---
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching the assignee of the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 216667] Self-contradictory description of inheritable capability set
2022-11-06 3:04 [Bug 216667] New: Self-contradictory description of inheritable capability set bugzilla-daemon
2023-05-19 2:11 ` [Bug 216667] " bugzilla-daemon
@ 2023-05-19 2:28 ` bugzilla-daemon
2023-05-19 13:26 ` bugzilla-daemon
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: bugzilla-daemon @ 2023-05-19 2:28 UTC (permalink / raw)
To: linux-man
https://bugzilla.kernel.org/show_bug.cgi?id=216667
--- Comment #2 from Monthero Ronald (rhmcruiser@gmail.com) ---
If curious you can also check the process capabilities set and decode their
capabilities set flags for - permitted, inherited and ambient as below.
The capabilities set can differ based on process , user and privileges
Example:
test$ ps alx | grep docker
4 0 2068 1 20 0 1834532 76808 - Ssl ? 0:16
/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
0 1000 70187 65976 20 0 17868 2504 pipe_r S+ pts/7 0:00 grep
--color=auto docker
test$
test$ egrep Cap /proc/2068/status
CapInh: 0000000000000000
CapPrm: 000001ffffffffff
CapEff: 000001ffffffffff
CapBnd: 000001ffffffffff
CapAmb: 0000000000000000
test$
Decode the capability flags for this process
test$ capsh --decode=000001ffffffffff
0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore
test$
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching the assignee of the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 216667] Self-contradictory description of inheritable capability set
2022-11-06 3:04 [Bug 216667] New: Self-contradictory description of inheritable capability set bugzilla-daemon
2023-05-19 2:11 ` [Bug 216667] " bugzilla-daemon
2023-05-19 2:28 ` bugzilla-daemon
@ 2023-05-19 13:26 ` bugzilla-daemon
2023-05-19 13:26 ` bugzilla-daemon
2023-05-25 0:55 ` bugzilla-daemon
4 siblings, 0 replies; 6+ messages in thread
From: bugzilla-daemon @ 2023-05-19 13:26 UTC (permalink / raw)
To: linux-man
https://bugzilla.kernel.org/show_bug.cgi?id=216667
--- Comment #3 from Alejandro Colomar (alx@kernel.org) ---
If you still feel some wording could be improved, I encourage you to send
a patch, according to the ./CONTRIBUTING file in the repo.
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching the assignee of the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 216667] Self-contradictory description of inheritable capability set
2022-11-06 3:04 [Bug 216667] New: Self-contradictory description of inheritable capability set bugzilla-daemon
` (2 preceding siblings ...)
2023-05-19 13:26 ` bugzilla-daemon
@ 2023-05-19 13:26 ` bugzilla-daemon
2023-05-25 0:55 ` bugzilla-daemon
4 siblings, 0 replies; 6+ messages in thread
From: bugzilla-daemon @ 2023-05-19 13:26 UTC (permalink / raw)
To: linux-man
https://bugzilla.kernel.org/show_bug.cgi?id=216667
Alejandro Colomar (alx@kernel.org) changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching the assignee of the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 216667] Self-contradictory description of inheritable capability set
2022-11-06 3:04 [Bug 216667] New: Self-contradictory description of inheritable capability set bugzilla-daemon
` (3 preceding siblings ...)
2023-05-19 13:26 ` bugzilla-daemon
@ 2023-05-25 0:55 ` bugzilla-daemon
4 siblings, 0 replies; 6+ messages in thread
From: bugzilla-daemon @ 2023-05-25 0:55 UTC (permalink / raw)
To: linux-man
https://bugzilla.kernel.org/show_bug.cgi?id=216667
--- Comment #4 from Monthero Ronald (rhmcruiser@gmail.com) ---
imho the current info of capabilities seem congruous.
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching the assignee of the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-05-25 0:55 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-06 3:04 [Bug 216667] New: Self-contradictory description of inheritable capability set bugzilla-daemon
2023-05-19 2:11 ` [Bug 216667] " bugzilla-daemon
2023-05-19 2:28 ` bugzilla-daemon
2023-05-19 13:26 ` bugzilla-daemon
2023-05-19 13:26 ` bugzilla-daemon
2023-05-25 0:55 ` bugzilla-daemon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).