0

I know it isn’t possible to setsecurity.capabilitiesattributes without uid 0 or CAP_SETFCAP.

However I was unable to find a complete list of what namespaces of names are allowed or what are those disallowed.

1

This is documented in the xattr(7) manual page:

Extended attribute namespaces

[…] Currently, the security, system, trusted, and user extended attribute classes are defined as described below. Additional classes may be added in the future.

Extended security attributes

[…] Read and write access permissions to security attributes depend on the policy implemented for each security attribute by the security module. When no security module is loaded, all processes have read access to extended security attributes, and write access is limited to processes that have the CAP_SYS_ADMIN capability.

Extended system attributes

[…] Read and write access permissions to system attributes depend on the policy implemented for each system attribute implemented by filesystems in the kernel.

Trusted extended attributes

Trusted extended attributes are visible and accessible only to processes that have the CAP_SYS_ADMIN capability. Attributes in this class are used to implement mecha‐ nisms in user space (i.e., outside the kernel) which keep information in extended attributes to which ordinary processes should not have access.

Extended user attributes

[…] The access permissions for user attributes are defined by the file permission bits: read permission is required to retrieve the attribute value, and writer permis‐ sion is required to change it.

  • Ok, let’s narrow the answer. In reality I’m only interested on ᴘᴄ versions of android marsmallow. – user2284570 Apr 14 '16 at 15:47

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.