How to spawn a process with specified capabilities

How to spawn a process with specified capabilities

Post by Eric Buddingt » Fri, 02 Mar 2001 00:16:47



I want to fork a new process with a particular capability set
(this happens in an init program I'm writing).

The problems is that execve() clears the capability set if the
filesystem doesn't support fs-capabilities, so I can't
make the change before exec.

execcap works around this by sharing a pipe between parent
and child that is close-on-exec, so the parent hangs on a
read from the pipe until it it returns (0), *then* sets the
child caps.

This basically works, but is inelegant since the child will
get to run for an undetermined amount of time (until
it blocks, realistically) before the caps are set.

In Real Life, this is OK, since the child will probably block
somewhere in the process of loading its shared libraries,
before it tries to do anything privileged. But this only a
stochastic asurance. Much better would be to start the
process in a STOPped state, set the caps, then
kill (child, CONT). No way to exec-stop, though.

Any ideas on a decent solution?

-Eric

 
 
 

1. spawned processes and process interdependencies

With Linux is it possible for a process to spawn subprocesses in such a
way that when the main process dies its subprocesses will automatically
die with it?

I'm trying to figure out this: Suppose one starts two instances of a
program. Each instance spawns subprocesses. But one of the instances gets
hosed up. How can one know which subprocesses were spawned by which
instance?

2. Installing new kernel

3. Apache can't spawn child process

4. VIA, 32bit PIO and 2.5.x kernel

5. Spawning a process without wait not possible?

6. Kernel Compiling Problems

7. Spawning a child process

8. know any file access

9. Prob spawning a process in my module ..

10. UID for Web Spawned processes

11. cannot spawn child process

12. Expect to background spawned process and exit

13. httpd won't spawn processes