lkml.org 
[lkml]   [2002]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Posix capabilities
    From
    Date
    "Theodore Ts'o" <tytso@mit.edu> writes:
    > On Thu, Oct 17, 2002 at 01:02:25PM +0200, Andreas Gruenbacher wrote:
    >> With capabilities the kernel ensures that
    >> applications cannot exceed their capabilities.

    Which is a _big_ plus.

    > as compared
    > to having every single individual administrator have make this
    > determination by his or herself.

    I don't see this. It's a distribution issue. There will be
    administrators, who want to do it on their own, but those will be a
    minority.

    > Each additional thing which the system administrator has to do, is an
    > additional thing that he/she can *get* *wrong*. System administators
    > aren't stupid, just over-loaded, and often asked to administer
    > something that's too complicated.

    Once the distributions have taken care of this, there's nothing too
    complicated left.

    > Millions and millions of knobs and dials are not necessarily a good
    > thing. If there is basically only one correct answer for how the
    > knobs can be set up, sure, you can have a complex database for
    > applications to determine what sort of capability masks they should
    > have, and you can run that database against your database every night
    > (otherwise, you might miss someone quietly modifying one or two
    > capability masks to leave him/herself a back door).
    >
    > But why go through all that effort?

    Because it's easier, than patching millions and millions of programs?

    Regards, Olaf.
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:30    [W:0.026 / U:1.220 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site