Re: ACL Question: normal user howto restrict root's permition ?

Hi~~~
thank you for your help:)
but ...
look details pls:

-------------------------------------
locahost:~# lcap
Current capabilities: 0xFFFFFEFF
   0) *CAP_CHOWN                   1) **CAP_DAC_OVERRIDE*
   2) *CAP_DAC_READ_SEARCH         3) *CAP_FOWNER
   4) *CAP_FSETID                  5) *CAP_KILL
   6) *CAP_SETGID                  7) *CAP_SETUID
   8)  CAP_SETPCAP                 9) *CAP_LINUX_IMMUTABLE
  10) *CAP_NET_BIND_SERVICE       11) *CAP_NET_BROADCAST
  12) *CAP_NET_ADMIN              13) *CAP_NET_RAW
  14) *CAP_IPC_LOCK               15) *CAP_IPC_OWNER
  16) *CAP_SYS_MODULE             17) *CAP_SYS_RAWIO
  18) *CAP_SYS_CHROOT             19) *CAP_SYS_PTRACE
  20) *CAP_SYS_PACCT              21) *CAP_SYS_ADMIN
  22) *CAP_SYS_BOOT               23) *CAP_SYS_NICE
  24) *CAP_SYS_RESOURCE           25) *CAP_SYS_TIME
  26) *CAP_SYS_TTY_CONFIG
    * = Capabilities currently allowed

/proc/sys/lids/lock_init_children: No such file or directory

locahost:~# lcap CAP_DAC_OVERRIDE
locahost:~# lcap
Current capabilities: 0xFFFFFEFD
   0) *CAP_CHOWN                   1)  *CAP_DAC_OVERRIDE*
   2) *CAP_DAC_READ_SEARCH         3) *CAP_FOWNER
   4) *CAP_FSETID                  5) *CAP_KILL
   6) *CAP_SETGID                  7) *CAP_SETUID
   8)  CAP_SETPCAP                 9) *CAP_LINUX_IMMUTABLE
  10) *CAP_NET_BIND_SERVICE       11) *CAP_NET_BROADCAST
  12) *CAP_NET_ADMIN              13) *CAP_NET_RAW
  14) *CAP_IPC_LOCK               15) *CAP_IPC_OWNER
  16) *CAP_SYS_MODULE             17) *CAP_SYS_RAWIO
  18) *CAP_SYS_CHROOT             19) *CAP_SYS_PTRACE
  20) *CAP_SYS_PACCT              21) *CAP_SYS_ADMIN
  22) *CAP_SYS_BOOT               23) *CAP_SYS_NICE
  24) *CAP_SYS_RESOURCE           25) *CAP_SYS_TIME
  26) *CAP_SYS_TTY_CONFIG
    * = Capabilities currently allowed

/proc/sys/lids/lock_init_children: No such file or directory

locahost:~# getfacl /tmp/test
getfacl: Removing leading '/' from absolute path names
# file: tmp/test
# owner: skywind
# group: skywind
user::rwx
user:root:---
group::---
mask::---
other::---

locahost:~# cat /tmp/test
123

-------------------------------------

I take away the *CAP_DAC_OVERRIDE*, but root can read the file still.

then I take away the *CAP_DAC_READ_SEARCH*, result is The root can't 
read the /tmp/test,
but can write /tmp/test still.........

Should I set another CAP to restrict root's write permition?

THKS~~~~~~~~~~~~




Chris Wright wrote:

>* Gang Xu ([email protected]) wrote:
>
>>[detailed]:
>>  skywind@localhost:~$ cat 123 > /tmp/test
>>  skywind@localhost:~$ chmod 700 /tmp/test
>>  skywind@localhost:~$ setfacl -m u:root:--- /tmp/test
>>  skywind@localhost:~$ su -
>>  localhost:~# cat /tmp/test
>>  123
>>  localhost:~#
>>
>>[result is:] 
>>  root can read the /tmp/test
>>
>>Why?
>>
>
>ACLs are both discretionary and overridable by process with proper
>capabilities (typically root).
>
>
>>I don't want root read the /tmp/test
>>How to do?
>>
>
>Take away relevant capabilities from the root process (such as
>CAP_DAC_OVERRIDE), or use mandatory access control (such as SELinux).
>
>thanks,
>-chris
>

_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel