Add CAP_CHOWN to permitted capability set#12908
Open
bryancall wants to merge 4 commits intoapache:masterfrom
Open
Add CAP_CHOWN to permitted capability set#12908bryancall wants to merge 4 commits intoapache:masterfrom
bryancall wants to merge 4 commits intoapache:masterfrom
Conversation
Add CAP_CHOWN to the permitted capability set retained after privilege drop. This allows plugins that perform cert file backup writes to set root ownership on newly created files when certs are restricted to root:root 600. Like CAP_DAC_OVERRIDE, CAP_CHOWN is held in the permitted set only and must be explicitly promoted to the effective set before use. It is not active during normal operation.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds CAP_CHOWN to the permitted capability set to enable plugins to change file ownership, specifically to support TLS certificate management plugins that need to set root:root ownership on backup certificate files.
Changes:
- Added
CAP_CHOWNto theperm_listarray inRestrictCapabilities(), making it available in the permitted set (but not the effective set) after privilege drop
cmcfarlen
previously approved these changes
Mar 3, 2026
Contributor
cmcfarlen
left a comment
cmcfarlen
left a comment
There was a problem hiding this comment.
Seems ok, but copilot raised some issue.
Add CHOWN_PRIVILEGE (0x10u) to the ElevateAccess privilege_level enum and wire up CAP_CHOWN in acquirePrivilege() so plugins can elevate file ownership capability through the standard ATS privilege API.
The assertion compared cap_count against sizeof(cap_list) which returns the byte size (16), not the element count (4). This could never catch an actual array overflow.
Replace the two-line comment with a concise description that covers the full scope of CAP_FOWNER, not just chmod.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
You can also share your feedback on Copilot code review. Take the survey.
Contributor
Author
|
[approve ci centos] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
CAP_CHOWNto the permitted capability set retained byRestrictCapabilities()after the privilege drop from root to the unprivileged user.This enables plugins that manage TLS certificate files to set
root:rootownership on backup copies they write to disk, supporting deployments where cert files are restricted toroot:root 600insideroot:root 700directories.Changes
src/tscore/ink_cap.cc-- AddedCAP_CHOWNtoperm_listinRestrictCapabilities(). LikeCAP_DAC_OVERRIDEandCAP_FOWNER, it is retained in the permitted set only (not effective). A plugin must explicitly promote it to the effective set before use.Security Considerations
CAP_CHOWNallows changing file ownership. It follows the same security model asCAP_DAC_OVERRIDE(already retained): held in the permitted set but not in the effective set during normal operation. A plugin must use RAII-style elevation to briefly promote it, then drop it immediately after thefchown()call.Testing
Verified on Fedora 43 with libcap 2.76:
CAP_CHOWNappears inCapPrmbut notCapEffafter startupfchown()succeeds when the capability is elevated