Changeset 2293 for trunk/server

Timestamp:

Aug 8, 2012, 11:15:29 AM (12 years ago)

Author:

ezyang

Message:

File capabilities respect nosuid too (https://github.com/torvalds/linux/blob/v3.5/security/commoncap.c#L434), so omit /var/lib/mock fscap files too.

File:

• trunk/server/fedora/config/etc/cron.d/check-filecaps (modified) (1 diff)

trunk/server/fedora/config/etc/cron.d/check-filecaps

@@ -1 +1 @@
 MAILTO=scripts-root@mit.edu
-27 5 * * * root find / -xdev -not -perm -o=x -prune -o -type f -print0 | xargs -0r /usr/sbin/getcap | cut -d' ' -f1 | grep -Fxvf /etc/scripts/allowed-filecaps.list | sed 's/^/Extra file_caps binary: /'
+27 5 * * * root find / -xdev -not -perm -o=x -prune -o -type f -print0 | xargs -0r /usr/sbin/getcap | cut -d' ' -f1 | grep -Fxvf /etc/scripts/allowed-filecaps.list | grep -ve ^/var/lib/mock/ | sed 's/^/Extra file_caps binary: /'