Hacker News new | ask | show | jobs
by dom0 3494 days ago
> capabilities

Well. There just aren't many useful caps to begin with. For example, consider backups. You'd want the backup system to have full read access to everything. Well. You can't do that with capabilities. You only get DAC_OVERRIDE, which is one of the many root-equivalent caps in Linux. Probably half of them are.
3 comments
ori_b 3494 days ago
Even better, in my opinion, is that many of the caps that you would use to sandbox an app (like PID and FS namespaces) require you to have the sysadmin capability set on the process.

Great. You need to give a process more or less root so that it can deny itself privileges.

link
dom0 3494 days ago
The idea is probably that the service manager (systemd) manages the NSs for the applications contained therein. systemd of course doesn't have to check it's own privileges.
link
bandrami 3494 days ago
GNU PIES, however, does check its own privileges. I have no idea why it didn't get a harder look during the init wars. I get that Shepherd "isn't there yet", but IMO Pies is.
link
ori_b 3494 days ago
But the binaries I want this on aren't services.
link
bandrami 3494 days ago
Which leads us to the full absurdity of CAP_SYS_ADMIN, which at this point even the kernel team admits is "basically root"
link
aaronmdjones 3494 days ago
You only need CAP_DAC_READ_SEARCH for backups.
link