lkml.org 
[lkml]   [1998]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 2.1.97] more capabilities support
Alan Cox writes:
> > 1) Don't store executables on the system with forced bits (this
> > requirement is automatically fulfilled in the current implementation
> > since we don't have file system support).
>
> That would come out as fixing the nosuid flag to no-[capability list]

If we can agree to the following constraint, I will withdraw my
objection to CAP_SETPCAP:

(as Alan suggests here) we build in a "no-[capability list]" mount
option for mounting filesystems. That is to say, a sys-admin can
trust a filesystem to reliably manipulate only a subset of the
total capabilities known to the system.

[Perhaps this was implicit all along to Astor?]

Best wishes

Andrew



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [from the cache]
©2003-2011 Jasper Spaans