Messages in this thread |  | | | Date | Mon, 20 Apr 1998 15:41:21 -0700 | | From | Andrew Morgan <> | | Subject | Re: [patch 2.1.97] more capabilities support |
| |
Alan Cox writes: > > 1) Don't store executables on the system with forced bits (this > > requirement is automatically fulfilled in the current implementation > > since we don't have file system support). > > That would come out as fixing the nosuid flag to no-[capability list]
If we can agree to the following constraint, I will withdraw my objection to CAP_SETPCAP:
(as Alan suggests here) we build in a "no-[capability list]" mount option for mounting filesystems. That is to say, a sys-admin can trust a filesystem to reliably manipulate only a subset of the total capabilities known to the system.
[Perhaps this was implicit all along to Astor?]
Best wishes
Andrew
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
|  |