Messages in this thread | | | Date | Sat, 29 Jan 2000 16:23:02 +0100 | From | Marek Habersack <> | Subject | RFC: capability to limit/allow access to various system info |
| |
Hi,
Lately I've been trying to develop a small utility for users who have only web/ftp access to their accounts on my server (mail via www and www page upload via ftp) that would allow them to see what is the status of their current quotas, number of files, blocks etc. The quota information is available only for programs running as UID 0, which I won't allow for any CGI script to run as. But, it ocurred to me that it would be easy to equip such a process with a capability that allows retrieving such information about the user. Right now the only capabilities that allow such access to this kind of information are CAP_SYS_ADMIN and CAP_SYS_RESOURCE. Both of them are far to powerful as they allow also write access to some areas of the system configuration. I thought it would be good to have a capability, say CAP_SYS_INFO, that would allow access to some system information (right now only quotas and resource limits come to my mind) for non UID0 processes. I think adding such thing to the kernel wouldn't be too hard, only a question remains whether it makes sense or not?
marek [unhandled content-type:application/pgp-signature] | |