Bug 2037215
| Summary: | Ambient capabilities failed to applied to non-root user even when correct rules are in /etc/security/capability.conf | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Zoltan Fridrich <zfridric> |
| Component: | libcap | Assignee: | Zoltan Fridrich <zfridric> |
| Status: | CLOSED ERRATA | QA Contact: | Martin Zelený <mzeleny> |
| Severity: | medium | Docs Contact: | Jan Fiala <jafiala> |
| Priority: | medium | ||
| Version: | 9.0 | CC: | bwelterl, dchen, hartsjc, jafiala, jpazdziora, lvrabec, morgan, msauton, mzeleny, omoris, rsroka, zfridric |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libcap-2.48-8.el9 | Doc Type: | Bug Fix |
| Doc Text: |
.Ambient capabilities are now applied correctly to non-root users
As a safety measure, changing a UID (User Identifier) from root to non-root nullifies permitted, effective, and ambient sets of capabilities.
However, the `pam_cap.so` module is unable to set ambient capabilities because a capability needs to be in both the permitted and the inheritable set to be in the ambient set. In addition, the permitted set gets nullified after changing the UID (for example by using the `setuid` utility), so the ambient capability cannot be set.
To fix this problem, the `pam_cap.so` module now supports the `keepcaps` option, which allows a process to retain its permitted capabilities after changing the UID from root to non-root. The `pam_cap.so` module now also supports the `defer` option, which causes `pam_cap.so` to reapply ambient capabilities within a callback to `pam_end()`. This callback can be used by other applications after changing the UID.
Therefore, if the `su` and `login` utilities are updated and PAM-compliant, you can now use `pam_cap.so` with the `keepcaps` and `defer` options to set ambient capabilities for non-root users.
|
Story Points: | --- |
| Clone Of: | 1950187 | Environment: | |
| Last Closed: | 2022-05-17 16:02:24 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2037212 | ||
| Bug Blocks: | |||
| Deadline: | 2022-01-25 | ||
|
Comment 15
errata-xmlrpc
2022-05-17 16:02:24 UTC
|