Re: CAP_LINUX_IMMUTABLE question

[Andreas Dilger]

Sean Hunter writes:
> I now want to drop CAP_LINUX_IMMUTABLE, and have (I think) done that.
> However, it seems to make no difference to my ability to set or clear
> the immutable attribute.  I tried this on ext2 and ext3 filesystems
> just to be on the safe side.
> 
> [root@henry /boot]# lcap CAP_LINUX_IMMUTABLE
> [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
> ---i--------- ./vmlinux-2.4.2-2smp
> [root@henry /boot]# chattr -i ./vmlinux-2.4.2-2smp
> [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
> ------------- ./vmlinux-2.4.2-2smp
> [root@henry /boot]# chattr +i ./vmlinux-2.4.2-2smp
> [root@henry /boot]# lsattr ./vmlinux-2.4.2-2smp
> ---i--------- ./vmlinux-2.4.2-2smp

The code that _should_ check this is fs/ext[23]/ioctl.c:EXT[23]_IOC_SETFLAGS,
so you may want to add some debugging there, to see:
1) if you really have dropped CAP_LINUX_IMMUTABLE
2) the logic of the checking is correct

Cheers, Andreas
-- 
Andreas Dilger  \ "If a man ate a pound of pasta and a pound of antipasto,
                 \  would they cancel out, leaving him still hungry?"
http://www-mddsp.enel.ucalgary.ca/People/adilger/               -- Dogbert