emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

newuidmap/newgidmap: install with file capabilities

Browse Source 
do not install newuidmap/newgidmap as suid binaries.  Running these
tools with the same euid as the owner of the user namespace to
configure requires only CAP_SETUID and CAP_SETGID instead of requiring
CAP_SYS_ADMIN when it is installed as a suid binary.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2018-10-24 11:08:28 +02:00
parent ff8b1ebafa
commit 70971457b7
2 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/Makefile.am
View File

@@ -61,8 +61,10 @@ if ACCT_TOOLS_SETUID
suidubins += chgpasswd chpasswd groupadd groupdel groupmod newusers useradd userdel usermod
endif
if ENABLE_SUBIDS
if !FCAPS
suidubins += newgidmap newuidmap
endif
endif
if WITH_TCB
shadowsgidubins = passwd
@@ -138,3 +140,9 @@ if WITH_TCB
chmod $(sgidperms) $(DESTDIR)$(ubindir)/$$i; \
done
endif
if ENABLE_SUBIDS
if FCAPS
setcap cap_setuid+ep $(DESTDIR)$(ubindir)/newuidmap
setcap cap_setgid+ep $(DESTDIR)$(ubindir)/newgidmap
endif
endif