getting "permission denied on key" against kernel.cad_pid & cap-bound values

Solution Verified - Updated -

Issue

Issue
As a non-root users, the file permissions show that anyone can issue the sysctl command to look at values, but there are two values in our system where only root can read/write.
/sbin/sysctl -a | grep kernel

error: permission denied on key 'kernel.cad_pid'

error: permission denied on key 'kernel.cap-bound'

.....

ls -l /proc/sys/kernel/ca*

-rw------- 1 root root 0 Nov 14 15:13 /proc/sys/kernel/cad_pid

-rw------- 1 root root 0 Nov 14 15:13 /proc/sys/kernel/cap-bound

.....
  • Should these two kernel values be set to 644, not 600 permission attributes?

Environment

  • Red Hat Enterprise Linux 5

Resolution

cap-bound was introduced in the 2.3.13 kernel and has been 600 since it was written

/proc/sys/kernel/cap-bound (from Linux 2.2 to 2.6.24)
              This file holds the value of the kernel capability bounding set
              (expressed as a signed decimal number).  This set is ANDed against the
              capabilities permitted to a process during execve(2).  Starting with
              Linux 2.6.25, the system-wide capability bounding set disappeared, and
              was replaced by a per-thread bounding set; see capabilities(7).

cad_pid was introduced in 2.4.10 and has also been 600 since.

/proc/sys/kernel/cad_pid is the pid value (default 1) that receives the ctrl+alt+del sequence.

It is not readily apparent to me why these may be 600 as opposed to 644.

This is the expected behavior.

Environment

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content