Date: Sat, 16 Apr 2022 20:17:06 +0300 From: George Diaconu <pgn.george@gmail.com> To: freebsd-hackers@freebsd.org Cc: Elena Mihailescu <maria.mihailescu@upb.ro>, =?UTF-8?B?yJhlbmRyZSBNaWhhaS1BbGlu?= <mihai.alin.sendre@gmail.com>, Darius MIHAI <darius.mihai@upb.ro> Subject: Linux capabilities to Capsicum Message-ID: <CAJ1Z2ub99U%2B2TVFs5qse_s=b8_zhjat_zfytYSQ2me1u0mQsGg@mail.gmail.com>
index | next in thread | raw e-mail
[-- Attachment #1 --] Hello, Together with my colleagues we are trying to port OpenStack to FreeBSD. As part of the process we need to modify a python package used by OpenStack called oslo_privsep. This package uses linux capabilities to give OpenStack services the least permissions they need. Now as part of porting to FreeBSD we want to replace the linux capabilities with Capsicum. We found a list of Capsicum capabilities at [1]. So far we found that the package uses at least the following 5 capabilities described in [2]: - CAP_DAC_OVERRIDE - CAP_DAC_READ_SEARCH - CAP_NET_ADMIN - CAP_SYS_PTRACE - CAP_SYS_ADMIN What would be the respective capabilities in Capsicum? Thank you, George [1] https://www.freebsd.org/cgi/man.cgi?query=rights&sektion=4&apropos=0&manpath=FreeBSD+13.0-RELEASE+and+Ports [2] https://man7.org/linux/man-pages/man7/capabilities.7.html [-- Attachment #2 --] <div dir="ltr">Hello,<div><br></div><div>Together with my colleagues we are trying to port OpenStack to FreeBSD. As part of the process we need to modify a python package used by OpenStack called oslo_privsep. This package uses linux capabilities to give OpenStack services the least permissions they need.</div><div>Now as part of porting to FreeBSD we want to replace the linux capabilities with Capsicum. We found a list of Capsicum capabilities at [1]. So far we found that the package uses at least the following 5 capabilities described in [2]:</div><div>- CAP_DAC_OVERRIDE</div><div>- CAP_DAC_READ_SEARCH</div><div>- CAP_NET_ADMIN</div><div>- CAP_SYS_PTRACE</div><div>- CAP_SYS_ADMIN</div><div><br></div><div>What would be the respective capabilities in Capsicum?</div><div><br></div><div>Thank you,</div><div>George</div><div><br></div><div>[1] <a href="https://www.freebsd.org/cgi/man.cgi?query=rights&sektion=4&apropos=0&manpath=FreeBSD+13.0-RELEASE+and+Ports" target="_blank">https://www.freebsd.org/cgi/man.cgi?query=rights&sektion=4&apropos=0&manpath=FreeBSD+13.0-RELEASE+and+Ports</a></div><div>[2] <a href="https://man7.org/linux/man-pages/man7/capabilities.7.html" target="_blank">https://man7.org/linux/man-pages/man7/capabilities.7.html</a></div></div>;help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAJ1Z2ub99U%2B2TVFs5qse_s=b8_zhjat_zfytYSQ2me1u0mQsGg>