[fpc-devel] Linux kernel behaviour change regarding keyboard

[Daniël Mantione]

Op Wed, 18 Jul 2007, schreef Sergei Gorelkin:

> Jonas Maebe wrote:
> > 
> > On 18 Jul 2007, at 14:08, Jonas Maebe wrote:
> > 
> > > > Install the IDE setuid.
> > > 
> > > That would be an extremely bad idea with the current stability record
> > > of the IDE.
> > 
> > Not to mention that it allows you to open and overwrite any arbitrary
> > file.
> > 
> 
> Looking at that kernel patch, I see that it requires not uid=0, but rather
> certain caller's capability present.
> I don't have deep knowledge of the subject, but 'capability' sounds like
> 'privilege' (in Windows terms) for me. If it is so, then probably there is a
> way to solve the problem by assigning the required capability to IDE user(s)
> or process.

Yes, you need a certain capability, but in practise this means you must 
be root. This is because:

* You can only drop a capability, not get a capability as a process.
* Root has all capabilities, users don't have any capabilities.

However, there is the SETPCAP capability, where a process can set the 
capabilities of another process. So, a setuid helper program cuild assign 
the needed capability if certain conditions are met. Unfortunately due to 
a security hole SETPCAP has been revoked from even root. Without kernel 
modification this possible solution is unfortunately sabotaged.

Daniël