similar to: [PATCH v1 0/2] Support dropping of capabilities from early userspace.

This patch adds the ability to kinit to allow the dropping of POSIX capabilities. kinit is modified by this change, such that it understands the new kernel command line "drop_capabilities=" that specifies a comma separated list of capability names that should be dropped before switching over to the next init in the boot strap (typically on the root disk). When processing capabilities

Building on the work in ff0a614bd724f6c4c6a5014a9955dc1bc028f336, this moves the capability code down into the run-init library, so that run-init can use it as well, via the new "-d" flag. Signed-off-by: Kees Cook <kees at outflux.net> --- usr/kinit/Kbuild | 3 +-- usr/kinit/capabilities.h | 10 ++++++++++ usr/kinit/kinit.c | 6 +++---

initramfs-tools wants to validate the real init program before running it, as there is no way out once it has exec'd run-init. This is complicated by the increasing use of symlinks for /sbin/init and for /sbin itself. We can't simply resolve them with 'readlink -f' because any absolute symlinks will be resolved using the wrong root. Add a dry-run mode (-n option) to run-init

systemd supports switching back to the initramfs during shutdown in order to make it easier to clean up the root file system. This is desirable in order to allow us to remove keys from RAM before rebooting, making it harder to obtain confidential information by rebooting into an environment that scrapes RAM contents. --- debian/changelog | 4 +

The following patches come from Debian and/or Ubuntu packages of klibc. Ben. Ben Hutchings (1): [klibc] run-init: Add dry-run mode Jay Vosburgh (1): [klibc] ipconfig: Use separate sockets for DHCP from multiple interfaces Mathieu Trudel-Lapierre (1): [klibc] ipconfig: Set broadcast when sending DHCPREQUEST and DHCPDISCOVER YunQiang Su (1): [klibc] mips: setjmp.S: don't

On a train ride to Bruxelles, brought out my axe and directly attacked run_init(8). run_init(8) is dead, long live switch_root(8). The next run on switch_root(8) involves fdopendir, so another push for the upcoming stdio 1.6 branch. The following is boot tested with initramfs-tools, kinit(8) tests would very much be appreciated!? Michal Suchanek (1): [klibc] switch_root: Fix single file

Peter, current klibc does not compile in ia64: gcc -Wp,-MT,arch/ia64/pipe.o,-MD,arch/ia64/.pipe.o.d -Os -fomit-frame-pointer -nostdinc -iwithprefix include -D__KLIBC__ -DBITSIZE=64 -I../include/arch/ia64 -I../include/bits64 -I../include -I../linux/include -I../linux/include2 -I../linux/include -DWITH_ERRLIST -W -Wall -Wpointer-arith -Wwrite-strings -Wstrict-prototypes -Winline -c -o

Hi all, i have some odd errors i never had before, when compiling samba 3.0.28a first i had an error in oplock_linux.c ------------ :37 error: conflicting types for capget /usr/include/sys/capability.h:111 previous declaration of capget was here :39 error: conflicting types for capset /usr/include/sys/capability.h:110 previous declaration of capset was here -------------- i removed the capset

Commit-ID: 10059fddba9f8bec6aeb0d37d217df6d65e64c3b Gitweb: http://git.kernel.org/?p=libs/klibc/klibc.git;a=commit;h=10059fddba9f8bec6aeb0d37d217df6d65e64c3b Author: Ben Hutchings <ben at decadent.org.uk> AuthorDate: Sun, 17 Jan 2016 19:50:28 +0000 Committer: Ben Hutchings <ben at decadent.org.uk> CommitDate: Wed, 2 Jan 2019 03:08:04 +0000 [klibc] run-init: Add dry-run mode

systemd supports switching back to the initramfs during shutdown in order to make it easier to clean up the root file system. This is desirable in order to allow us to remove keys from RAM before rebooting, making it harder to obtain confidential information by rebooting into an environment that scrapes RAM contents. Signed-off-by: Matthew Garrett <mjg59 at google.com> ---

Commit-ID: 603f1bb024a03d9c50a89e7256ae7814292baf06 Gitweb: http://git.kernel.org/?p=libs/klibc/klibc.git;a=commit;h=603f1bb024a03d9c50a89e7256ae7814292baf06 Author: Matthew Garrett <matthewgarrett at google.com> AuthorDate: Thu, 18 Apr 2019 12:12:27 -0700 Committer: Ben Hutchings <ben at decadent.org.uk> CommitDate: Sat, 20 Apr 2019 17:11:34 +0100 [klibc] run-init: Allow

Greetings list, I just upgraded my main file server, and copied over a dump of my LDAP database, samba conf files, tdbs, etc. Everything fired up OK and runs, except: -Some users (perhaps 5 or 6 out of 125) can't log in, getting the "domain unavailable" message -I can't rejoin them to the domain - the process appears to succeed, but doesn't -One of the machine accounts

Hello, While some people might scuba dive, let's summarize recent progress and state (People cc'ed have either patches in queue or are involved): * Patches pending review, allmost ready for klibc ------------------------------------------------- - mikew/drop_cap - kinit: Add drop_capabilities support adds the ability to kinit to allow the dropping of POSIX capabilities. (patch even

Remove FORCE from the list used by if_changed and friends. Otherwise the target will always be considered out of date when built with make 3.82.

The following patchset implements 3 seperate series of changes. External Building ================= Patches 1 through 8 enable to use of klibc's build system while leaving the src tree pristine (and potentially read only). Specifically: - srctree=<Sources for klibc> - objtree=<Ouput directory for klibc> - KLIBCKERNELSRC=<Kernel sources> - KLIBCKERNELOBJ=<Kernel

Hello, I was using a bunch of cpios in initramfs as a working system, and wondering why the unused files weren't being paged out to swap. So I reread ramfs-rootfs-initramfs.txt and now I know. So I wrote the attached utility. It creates a tmpfs, moves all files on the initramfs, moves / and executes the real init. It works, even with hardlinks, but it isn't the correct approach. Have

Commit-ID: 163920f31f98db13f4e37796bb92f0844e7aaf45 Gitweb: http://git.kernel.org/?p=libs/klibc/klibc.git;a=commit;h=163920f31f98db13f4e37796bb92f0844e7aaf45 Author: maximilian attems <max at stro.at> AuthorDate: Tue, 29 May 2012 18:58:31 +0200 Committer: maximilian attems <max at stro.at> CommitDate: Tue, 29 May 2012 19:03:08 +0200 [klibc] capabilities: Use fflush() instead

Commit-ID: 8544fef6d5e5bc8f927ffbd3e4031b905c907de9 Gitweb: http://git.kernel.org/?p=libs/klibc/klibc.git;a=commit;h=8544fef6d5e5bc8f927ffbd3e4031b905c907de9 Author: maximilian attems <max at stro.at> AuthorDate: Sun, 27 May 2012 23:18:07 +0200 Committer: maximilian attems <max at stro.at> CommitDate: Sun, 27 May 2012 23:18:07 +0200 [klibc] kinit: Fix capabilities alternate

I had a klibc build failure (on s390) because of include/sys/module.h and noticed that it still has the old system call interface for 2.4 style modutils. Is there any reason to keep that in klibc? This patch fixes the build problem by removing the old file and also makes it possible to build module-init-tools (after some tweaking there) against klibc. Arnd <>< =====

--9jxsPFA5p3P2qPhR Content-Type: text/plain; charset=us-ascii Content-Disposition: inline I stripped down the insmod command from modules-init-tools for use with klibc. Rusty agreed to have this contributed to klibc. The second patch removes old style modules support. -- ciao, Marco --9jxsPFA5p3P2qPhR Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment;