Inheritable file system capabilities

[Florian Weimer]

We've been looking at file system capabilities recently.

I noticed this particular instance in Fedora:

wireshark,/usr/sbin/dumpcap,"= cap_net_admin,cap_net_raw+eip"

If I understand things correctly, the "i" part is unnecessary because 
dumpcap doesn't spawn other programs (unless exploited, that is).  So 
making these capabilities non-inheritable makes sense to me.

Comments?

-- 
Florian Weimer / Red Hat Product Security Team

[Florian Weimer]

On 10/10/2013 09:46 AM, Florian Weimer wrote:
>  We've been looking at file system capabilities recently.
>
>  I noticed this particular instance in Fedora:
>
>  wireshark,/usr/sbin/dumpcap,"= cap_net_admin,cap_net_raw+eip" 
No replies, so I filed to bug 1022377 to get this fixed.

-- 
Florian Weimer / Red Hat Product Security Team