[tor-bugs] #8195 [Tor]: tor and capabilities

[Tor Bug Tracker & Wiki]

#8195: tor and capabilities
-----------------------------+--------------------------------
     Reporter:  weasel       |      Owner:
         Type:  enhancement  |     Status:  needs_revision
     Priority:  normal       |  Milestone:  Tor: 0.2.5.x-final
    Component:  Tor          |    Version:
   Resolution:               |   Keywords:  tor-relay security
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+--------------------------------

Comment (by dgoulet):

 I hacked on it on the plane back from Island and I actually improve it
 quite a bit! The new version, not ready yet (but pushed on the same
 branch), now drops every capabilities except the one we need for the root
 process to setuid/setgid and then after only sets the two capabilities
 that I found that we need which are CAP_CHOWN and CAP_NET_BIND_SERVICE.

 Once this is cleaned up I'll do a test that uses that compat API and make
 sure we have the expecting results like you mention.

 I'll update back this when I have a patch that I'm satisfied with for
 review! Should be quite soon!

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8195#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online