search for: pr_capbset_drop

...order that capabilities are given does not cause dropping of later enumerated capabilities to fail if it is listed early on. Dropping of capabilities happens in three parts. We explicitly drop the capability from init's inherited masks. We also drop the capability from the bounding set using PR_CAPBSET_DROP so that later setuid execs are bounded. Lastly, we drop the capabilities from the bset and inheritted masks exposed at /proc/sys/kernel/usermodehelper if available (introduced in Linux v3.0.0). In all paths, we treat errors as fatal, as we do not want to continue to boot if there was a problem dr...

Hi All, I am running libvirt-1.1.2 on Scientific Linux release 6.1 (Carbon). I compiled the libvirtd rpms and installed them on to my system. I see this error 2014-04-11 05:37:42.351+0000: 12378: error : virCommandWait:2348 : internal error: Child process (LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin /usr/libexec/qemu-kvm -help) unexpected exit status 1: libvirt: error : internal error: cannot

...; take CAP_SYS_RAWIO away from everything ? >> > > Alright, I see your point. ? ISTR that CAP_SYS_RAWIO was required for > accessing block devices directly, but this doesn't seem to be the > case. > > I think the approach I'll try next is to try and drop it with > PR_CAPBSET_DROP from early userspace's init. > For my use-case, I'd like to have a system boot with a non-default bounding set of posix capabilities. I'd like the system to *never* be able to use these capabilities, so I'd like to drop them early on when userland starts up. Given this require...

This patchset applies to klibc mainline. As is it will probably collide with Maximilian's recent patch to rename run-init to switch_root posted last week. To boot an untrusted environment with certain capabilities locked out, we'd like to be able to drop the capabilities up front from early userspace, before we actually transition onto the root volume. This patchset implements this by