[rsbac] cap chown etc.
ao at rsbac.org
Sat May 31 11:53:09 MEST 2003
On Saturday, 31. May 2003 05:28, Arkady A Drovosekov wrote:
> well, I've written not very clear. I'd like to assign the CHOWN capability
> to some file/process/role and limit values for chown to
> several defined uids/gids. Something like
> attr_set_file_dir -a CAP FILE /usr/sbin/daemon min_caps SETUID uids 1000
What you can do is add a CHOWN CAP to daemon and then restrict the set with
AUTH. This scheme works fine here. Group id support has not been added to
AUTH yet, because it was seen as irrelevant.
There is no way to check uids in CAP module, because it only sets Linux
capabilities, which do not support them.
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22
More information about the rsbac