标签：linux linux-capabilities execve

我想在没有setuid,文件“p”功能的情况下使系统可用,并且通常没有在设置PR_SET_NO_NEW_PRIVS时禁用的东西.

使用这种方法(init不再可能设置PR_SET_NO_NEW_PRIVS和基于文件系统的功能提升),您无法“重新填充”您的功能,只需要注意不要“泼溅”它们.

如何在没有“泼溅”任何已授权的功能的情况下执行其他一些过程(例如,如果新程序的文件是setcap = ei)？只是“我相信这个新过程,因为我相信自己”.例如,一个能力被赋予用户(并且用户想要在他开始的任何程序中运用它)……

我可以永久地创建整个文件系统= ei吗？我想保持文件系统不干扰该方案,不能授予或撤销功能;通过父母 – >儿童事物来控制一切.

解决方法:

我并不是说我建议你这样做,但在这里.

从手册中提取,有一些变化.根据它：fork不会改变功能.现在在Linux内核4.3中添加了一个环境集,似乎这是你想要做的.

   Ambient (since Linux 4.3):
          This is a set of capabilities that are preserved across an execve(2) of a program that is not privileged.  The ambient capability set obeys the invariant that no capability can ever
          be ambient if it is not both permitted and inheritable.

          The ambient capability set can be directly modified using
          prctl(2).  Ambient capabilities are automatically lowered if
          either of the corresponding permitted or inheritable
          capabilities is lowered.

          Executing a program that changes UID or GID due to the set-
          user-ID or set-group-ID bits or executing a program that has
          any file capabilities set will clear the ambient set.  Ambient
          capabilities are added to the permitted set and assigned to
          the effective set when execve(2) is called.

   A child created via fork(2) inherits copies of its parent's
   capability sets.  See below for a discussion of the treatment of
   capabilities during execve(2).

Transformation of capabilities during execve()
   During an execve(2), the kernel calculates the new capabilities of
   the process using the following algorithm:

       P'(ambient) = (file is privileged) ? 0 : P(ambient)

       P'(permitted) = (P(inheritable) & F(inheritable)) |
                       (F(permitted) & cap_bset) | P'(ambient)

       P'(effective) = F(effective) ? P'(permitted) : P'(ambient)

       P'(inheritable) = P(inheritable)    [i.e., unchanged]

   where:

       P         denotes the value of a thread capability set before the
                 execve(2)

       P'        denotes the value of a thread capability set after the
                 execve(2)

       F         denotes a file capability set

       cap_bset  is the value of the capability bounding set (described
                 below).

   A privileged file is one that has capabilities or has the set-user-ID
   or set-group-ID bit set.

标签：linux,linux-capabilities,execve
来源： https://codeday.me/bug/20190620/1245670.html

本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享；
2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关；
3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关；
4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除；
5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。