lkml.org 
[lkml]   [2000]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Capabilities
Hi!

> Pavel also mentioned that there's no way to prevent exec--I disagree
> (though I haven't looked at the list of capabilities in Linux or
> Posix, I'm afraid). Certainly, if you deny exec abilities you also
> want to deny, at least, the ability to mmap files as executable, and
> you also want to arrange that executable pages are never writable.

Right. But normal apps need ability to mmap as executable...

> And most importantly, the big thing that exec could do that mmap can't
> is get new capabilities by execing a setcap executable. (Sure, I can
> mmap su into myself. So what? I can't actually do anything with
> it!)

Yes, I forgot. You can easily deny exec of setuid programs.
Pavel
--
The best software in life is free (not shareware)! Pavel
GCM d? s-: !g p?:+ au- a--@ w+ v- C++@ UL+++ L++ N++ E++ W--- M- Y- R+

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:56    [W:0.100 / U:5.588 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site