![]() | ||||||||||
Messages in this thread |
On Mon, 15 Dec 2003, Felix von Leitner wrote: > I would like to be able to drop capabilities that every normal user has, > so that network servers can limit the impact of possible future security > problems further. For example, I want my non-cgi web server to be able > to drop the capabilities to > > * fork > * execve > * ptrace > * load kernel modules > * mknod > * write to the file system > > and I would like to modify my smtpd to not be able to > > * fork > * execve > * ptrace > * load kernel modules > * mknod You can specify policy under SELinux to acheive this (without modifying any applications). - James -- James Morris <jmorris@redhat.com> - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | |||||||||
| Last update: 2005-03-22 12:59 [from the cache] ©2003-2008 | ||||||||||