Messages in this thread | | | Date | Sat, 10 Apr 1999 17:59:13 -0400 (EDT) | From | "David L. Parsley (lkml account)" <> | Subject | Re: [PATCH] Capabilities, this time in elf section |
| |
On Sat, 10 Apr 1999, Daniel Taylor wrote:
> You need capabilities directly tied to the UID or you cannot > securely eliminate root from the system.
Please follow the link I posted earlier (and repeated below) to the linux-privs (capabilities) info. To quote:
"At the heart of the changes to the Linux kernel from the historical model is the separation of identity and privilege."
Pretty much the opposite of what you're saying.
Note: the capabilities stuff is a little complex, esp. wrt file cap sets, process cap sets, and the way caps are passed on during an exec. Even the available documentation isn't completely clear to me, and now it's time to read the code, too. You may misunderstand, too, that capabilities and their behavior are _already_ coded in the kernel; we're just trying to make use of a kernel feature that's already present, but not currently in use due to lack of support in the fs.
For your elucidation: http://www1.us.kernel.org/pub/linux/libs/security/linux-privs/doc/linux-privs.html/linux-privs.html
- -- David L. Parsley Network Specialist City of Salem Schools
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |