GNOME Bugzilla – Bug 649560
Improve checks for fs capabilities
Last modified: 2011-06-18 07:40:27 UTC
I'm attaching two patches that I think improve things wrt filesystem capabilities: - first one really makes sure that we have ipc_lock, and drop everything else - second one makes it possible to run even if we don't have ipc_lock
Created attachment 187350 [details] [review] Improved checks for fs capabilities, and drop unneeded ones If we have fs capabilities, we first need to check that we really do have ipc_lock, and if that's the case we just keep ipc_lock and drop everything else.
Created attachment 187351 [details] [review] Accept to run if ipc_lock capability is not available We print a warning about potential use of unsecure memory, but still run (and drop unneeded capabilities if we have some). This is better than nothing.
Oh, hrm, it's worth mentioning that I wasn't able to test the patches myself (well, except for the second one) as my kernel currently doesn't have fs caps turned on. So make sure to double-check things :-)
Tomas, can you review these?
Seems to be working fine on fscaps-enabled system. The second patch is great to have and I wanted to propose something like that (though I haven't tested it when fscaps are not set). I've received bugreport from an user having root fs on nfs, which doesn't support extattrs and thus no fscaps. We'd still like to allow g-k-d to run in such cases.
Submitted for testing in Fedora: gnome-keyring-3.1.1-2.fc16 gnome-keyring-3.0.1-2.fc15
Thanks, I pushed to master. I can cherry-pick on gnome-3-0 if this is wanted.
Thanks! I'm not doing any more releases on the 3.0 branch, so cherry-picking isn't necessary.