如何解决尽管缺少基于文件系统的功能,如何执行流程并保留功能?
我并不是说我建议您这样做,但这就是这里。
从手册中摘录,进行了一些更改。据它:fork
不改变能力。而 ,似乎这又是为了什么你正在尝试做的。
Ambient (since Linux 4.3):
This is a set of capabilities that are preserved across an execve(2) of a program that is not privileged. The ambient capability set obeys the invariant that no capability can ever
be ambient if it is not both permitted and inheritable.
The ambient capability set can be directly modified using
prctl(2). Ambient capabilities are automatically lowered if
either of the corresponding permitted or inheritable
capabilities is lowered.
Executing a program that changes UID or GID due to the set-
user-ID or set-group-ID bits or executing a program that has
any file capabilities set will clear the ambient set. Ambient
capabilities are added to the permitted set and assigned to
the effective set when execve(2) is called.
A child created via fork(2) inherits copies of its parent's
capability sets. See below for a discussion of the treatment of
capabilities during execve(2).
Transformation of capabilities during execve()
During an execve(2), the kernel calculates the new capabilities of
the process using the following algorithm:
P'(ambient) = (file is privileged) ? 0 : P(ambient)
P'(permitted) = (P(inheritable) & F(inheritable)) |
(F(permitted) & cap_bset) | P'(ambient)
P'(effective) = F(effective) ? P'(permitted) : P'(ambient)
P'(inheritable) = P(inheritable) [i.e., unchanged]
where:
P denotes the value of a thread capability set before the
execve(2)
P' denotes the value of a thread capability set after the
execve(2)
F denotes a file capability set
cap_bset is the value of the capability bounding set (described
below).
A privileged file is one that has capabilities or has the set-user-ID
or set-group-ID bit set.
解决方法
我想使系统在没有setuid
文件“ +
p”功能的情况下可用,并且在没有设置PR_SET_NO_NEW_PRIVS时被禁用的功能中,通常使之可用。
使用这种方法(不再能够基于init
集合PR_SET_NO_NEW_PRIVS
和基于文件系统的功能提升),您不能“重新填充”您的功能,而只需要注意不要“泼洒”它们。
如何在execve
不“散布”任何授予的功能的情况下进行其他处理(例如,如果新程序的文件为setcap
=ei
)?只是“我相信这个新过程就像我相信自己一样”。例如,向 用户 提供了一项 功能 (并且该用户想在他启动的任何程序中进行锻炼)…
我可以永久制作整个文件系统=ei
吗?我要保持文件系统不干扰该方案,不能授予或撤消功能;通过父->子事物控制一切。
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。