Quoting Mantas Mikulėnas ([email protected]): > On Tue, May 27, 2014 at 4:31 PM, Michal Witanowski > <[email protected]> wrote: > > Hi, > > > > first of all I'd like to mark that I'm not sure if I'm writing in the right > > place. > > > > I have a problem with running a systemd service in "capability-only > > environment": I want to run a process with some caps (cap_sys_admin > > cap_dac_override cap_mac_override) as a regular user (UID != 0). > > My service config file looks something like this: > > > > User=test > > CapabilityBoundingSet=cap_sys_admin cap_dac_override cap_mac_override > > Capabilities=cap_sys_admin,cap_dac_override,cap_mac_override=eip > > SecureBits=keep-caps > > > > Unfortunately, the process does not gain any permissive capabilities: > > > > CapInh: 0000000100200002 > > CapPrm: 0000000000000000 > > CapEff: 0000000000000000 > > CapBnd: 0000000100200002 > > > > However, when I run the service as root (by removing "User=test") the > > process does own required caps: > > > > CapInh: 0000000100200002 > > CapPrm: 0000000100200002 > > CapEff: 0000000100200002 > > CapBnd: 0000000100200002 > > Does the executable file itself have these capabilities set as "=ei"? > > According to the same manual page, each capability must be set as > inheritable for both the process and the file, to receive them _at > all_... > > "P'(permitted) = (P(inheritable) & F(inheritable)) | (F(permitted) & > cap_bset)" > > ...and as effective on the file, otherwise the new process has to > manually 'enable' them: > > "P'(effective) = F(effective) ? P'(permitted) : 0" > > ...or at least that seems to be how it works. Damn thing is confusing.
Correct. keep_caps is about not dropping the capabilities when dropping all 0 uids, i.e. when systemd does setuid(test). But systemd is going to proceed to exec(), causing the capabilities to be re-execed from there. So as Mantas wrote, I think what you want is to set cap_sys_admin,cap_dac_override,cap_mac_override=ie to the file you are executing. So long as you don't also set it to 'p', this should be ok as only processes with cap_sys_admin,cap_dac_override,cap_mac_override=i will inherit it from the file. Kinda neat, I especially like the ability to also lock the service into no-setuid and noroot secbits. -serge _______________________________________________ systemd-devel mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/systemd-devel
