getting "permission denied on key" against kernel.cad_pid & cap-bound values
Issue
Issue
As a non-root users, the file permissions show that anyone can issue the sysctl command to look at values, but there are two values in our system where only root can read/write.
/sbin/sysctl -a | grep kernel
error: permission denied on key 'kernel.cad_pid'
error: permission denied on key 'kernel.cap-bound'
.....
ls -l /proc/sys/kernel/ca*
-rw------- 1 root root 0 Nov 14 15:13 /proc/sys/kernel/cad_pid
-rw------- 1 root root 0 Nov 14 15:13 /proc/sys/kernel/cap-bound
.....
- Should these two kernel values be set to 644, not 600 permission attributes?
Environment
- Red Hat Enterprise Linux 5
Resolution
cap-bound was introduced in the 2.3.13 kernel and has been 600 since it was written
/proc/sys/kernel/cap-bound (from Linux 2.2 to 2.6.24)
This file holds the value of the kernel capability bounding set
(expressed as a signed decimal number). This set is ANDed against the
capabilities permitted to a process during execve(2). Starting with
Linux 2.6.25, the system-wide capability bounding set disappeared, and
was replaced by a per-thread bounding set; see capabilities(7).
cad_pid was introduced in 2.4.10 and has also been 600 since.
/proc/sys/kernel/cad_pid is the pid value (default 1) that receives the ctrl+alt+del sequence.
It is not readily apparent to me why these may be 600 as opposed to 644.
This is the expected behavior.
Environment
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.