Re: rights(4) split? CAP_WRITE -> CAP_WRITE_DATA + CAP_WRITE_CTRL

On 6/3/26 12:21, Vinícius dos Santos Oliveira wrote:
> Em ter., 2 de jun. de 2026 às 15:20, Kyle Evans <[email protected]> escreveu:
>> I'm looking at an application where it would be useful to be able to construct a socketpair(2) that can't be used to send fds over, out of an abundance of caution.
> 
> FWIW Linux added SO_PASSRIGHTS to disable the reception of fds:
> https://lwn.net/Articles/1023085/
> 

Indeed, this is an independently useful feature that I would love to adopt.

>> The application in prison0 is effectively a broker between two jails that it hands each an end of the socketpair, then steps out of the way -- I don't see a reason to leave it capable of carrying SCM_RIGHTS.
> 
> This case can't be dealt with using Linux's SO_PASSRIGHTS so a new
> design that deviates from previous solutions (such as Linux's) is
> required.
> 

Right, if it were instead the case that I trusted that one of the endpoints couldn't be compromised, then I'd happily implement SO_PASSRIGHTS, use it and call it a day- alas, as you pointed out, for a case like this I'm much happier if can revoke the capability completely and not worry about it.

> I don't have much to say on this matter, so my comments end here.

Thanks,

Kyle Evans