Re: ACL Question: normal user howto restrict root's permition ?

* Gang Xu ([email protected]) wrote:
> [detailed]:
>   skywind@localhost:~$ cat 123 > /tmp/test
>   skywind@localhost:~$ chmod 700 /tmp/test
>   skywind@localhost:~$ setfacl -m u:root:--- /tmp/test
>   skywind@localhost:~$ su -
>   localhost:~# cat /tmp/test
>   123
>   localhost:~#
> 
> [result is:] 
>   root can read the /tmp/test
> 
> Why?

ACLs are both discretionary and overridable by process with proper
capabilities (typically root).

> I don't want root read the /tmp/test
> How to do?

Take away relevant capabilities from the root process (such as
CAP_DAC_OVERRIDE), or use mandatory access control (such as SELinux).

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net
_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel