Re: [RFC PATCH iproute2] Drop capabilities if not running ip exec vrf with libcap

On Tue, 2018-03-27 at 10:15 -0700, Stephen Hemminger wrote: > On Tue, 27 Mar 2018 17:24:19 +0100 > Luca Boccassi wrote: > > > ip vrf exec requires root or CAP_NET_ADMIN, CAP_SYS_ADMIN and > > CAP_DAC_OVERRIDE. It is not possible to run unprivileged commands > > like > > ping as non-root or non-ca

Re: [RFC PATCH iproute2] Drop capabilities if not running ip exec vrf with libcap

On Tue, 27 Mar 2018 17:24:19 +0100 Luca Boccassi wrote: > ip vrf exec requires root or CAP_NET_ADMIN, CAP_SYS_ADMIN and > CAP_DAC_OVERRIDE. It is not possible to run unprivileged commands like > ping as non-root or non-cap-enabled due to this requirement. > To allow users and administrators to sa

Re: [RFC PATCH iproute2] Drop capabilities if not running ip exec vrf with libcap

On Tue, 2018-03-27 at 10:40 -0600, David Ahern wrote: > On 3/27/18 10:24 AM, Luca Boccassi wrote: > > ip vrf exec requires root or CAP_NET_ADMIN, CAP_SYS_ADMIN and > > CAP_DAC_OVERRIDE. It is not possible to run unprivileged commands > > like > > ping as non-root or non-cap-enabled due to this requ

Re: [RFC PATCH iproute2] Drop capabilities if not running ip exec vrf with libcap

On 3/27/18 10:24 AM, Luca Boccassi wrote: > ip vrf exec requires root or CAP_NET_ADMIN, CAP_SYS_ADMIN and > CAP_DAC_OVERRIDE. It is not possible to run unprivileged commands like > ping as non-root or non-cap-enabled due to this requirement. > To allow users and administrators to safely add the req

[RFC PATCH iproute2] Drop capabilities if not running ip exec vrf with libcap

ip vrf exec requires root or CAP_NET_ADMIN, CAP_SYS_ADMIN and CAP_DAC_OVERRIDE. It is not possible to run unprivileged commands like ping as non-root or non-cap-enabled due to this requirement. To allow users and administrators to safely add the required capabilities to the binary, drop all capabil