Messages in this thread | | | From | "Khimenko Victor" <> | Date | Mon, 21 Feb 2000 20:49:44 +0300 (MSK) | Subject | Re: Capabilities |
| |
In <20000221120431.A584@sb.t-online.de> Christoph Hellwig (chhellwig@gmx.net) wrote: > On Sun, Feb 20, 2000 at 09:42:22PM -0300, Horst von Brand wrote: >> Pavel Machek <pavel@suse.cz> said: >> > In-Reply-To: <200002192338.e1JNcw216382@sleipnir.valparaiso.cl>; from vonbrand@ >> > ***sleipnir.valparaiso.cl on Sat, Feb 19, 2000 at 08:38:58PM -0300 >> >> > > > If you want to elevate some priviledges, make it setuid 0 (that will >> > > > give it all capabilities) and you can now copy forced into >> > > > allowed. You are done. You have nice compatibility (ls) for free, and >> > > > you have 32 more bits for your use! >> >> > > Who says running as UID == 0 gives you all capabilities? Why have a >> >> > Backwards compatibility. >> >> Doesn't cut it: It is _exactly_ what capabilities are designed to avoid. >> You can get (some) backwards compatibility by setting capabilities >> adequately.
> I thin we should do it so, but this is a userlevel featue. > We should ad a rc file /etc/capabilitys with following content:
> capabyility:passwd:initialusers > | | > | | users, whiches login-shell inherits this cap form login > | the passwd you need to get this cap ( like IRIX su -C <cap> )
>> >> > > distinguished root user at all? OTOH, it does make sense to have a program >> > > that can modify files belonging to DNS, and which is allowed to bind to a >> > > low port, but nothing else. The UID/GID (and ACL) stuff and capabilities >> > > are complementary. >> >> > I said that different uid is where this gets ugly ;-). Take a look at >> > elfcap.
> I think we should get elfcap into the kernel before 2.4. In 2.5 we can replace it with > properly integration of capabilitys in the filesystem.
This is NOT how Linux development are going. -- cut -- I prefer to have a known bug that will eventually get fixed than an ugly solution that will hide it forever.
Linus -- cut --
So elfcap SHOULD NOT go into the kernelbefore 2.4 :-) This is exactly "ugly solution" mentioned above...
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |