Please support setuid/setgid in ACLs (fwd)

FYI - forwarding some issues raised by Andras Korn on the
Debian lists...

----- Forwarded message from Andras Korn <[email protected]> -----

Date: Sun, 5 Sep 2004 15:18:30 +0200
To: Debian Bug Tracking System <[email protected]>
Organization: Technical University of Budapest, Department of Calculus
User-Agent: Mutt/1.5.6+20040818i
Reply-To: Andras Korn <[email protected]>,
   [email protected]
From: Andras Korn <[email protected]>
Subject: Bug#270101: Please support setuid/setgid in ACLs

Package: acl
Version: 2.2.23-1
Severity: wishlist

Hi,

imagine the following scenario: you have a binary that you wish group A to
be able to execute, and group B to be able to execute setuid.

This can't currently be done; if the binary is setuid, you can make it
executable by group B only, in which case group B will have setuid execute
access, but group A will have no access.

Similar problems arise when trying to grant selective access to the setgid
bit (and the sticky bit, but that doesn't seem useful in this context).

Effectively, I'd like to be able to say something like:

setfacl -m g:somegroup:rwu binary # for setuid
setfacl -m g:somegroup:rwg binary # for setgid
setfacl -m g:somegroup:rws binary # for setuid and setgid
setfacl -m g:somegroup:rwU binary # for setuid but no execute
setfacl -m g:somegroup:rwG binary # for setgid but no execute
setfacl -m g:somegroup:rwS binary # for setuid and setgid but no execute

Obviously, other notations would be possible and perhaps more practical.

I realize this is hard to do because quite a bit of the infrastructure would
have to be changed to implement the semantics.

I also realize the Debian BTS may not be the best place to file this report;
my primary motivation now is to have this written down so that it can catch
the eye of someone willing to work on it.

Best regards,

Andras

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.7-chardonnay
Locale: LANG=C, LC_CTYPE=hu_HU

Versions of packages acl depends on:
ii  libacl1                     2.2.23-1     Access control list shared library
ii  libattr1                    2.4.16-1     Extended attribute shared library
ii  libc6                       2.3.2.ds1-16 GNU C Library: Shared libraries an

-- no debconf information

-- 
                 Andras Korn <korn at chardonnay.math.bme.hu>
                 <http://chardonnay.math.bme.hu/~korn/>	QOTD:
             Time is a great teacher, but it kills all its pupils.


----- End forwarded message -----

-- 
Nathan

_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel