Post #1539624
2025-11-17 13:55 UTC
@funkylab Instead of changing to root, we keep the current uid/gid and instead give it full ambient capabilities (https://man7.org/linux/man-pages/man7/capabilities.7.html). That's sufficient to pass all kernel privilege checks (disregarding LSMs). To pass polkit checks, we run the "run0 --empower" session with the new "empower" group as an auxiliary group and we ship a polkit rule to allow all actions for users in the "empower" group.
Note that this won't work if a tool checks for uid 0 instead of capabilities.
Replies (3)
-
@funkylab@mastodon.social 2025-11-17 13:58
@daandemeyer ah but which capability would give a process power to read a root:root-owned 0600 config file?
-
@bugaevc@floss.social 2025-11-17 14:02
@daandemeyer @funkylab that's cursed, I love it
-
@felixs@chaos.social 2025-11-21 10:25
@daandemeyer @funkylab Do I get that correctly that this is safe from e.g. manipulation by a debugger because the newly spawned process is not a child of run0 but of systemd, and therefore the debugger can normally not attach?