![]() | |||||||||||
Messages in this thread |
Stephen Smalley wrote: > On Fri, 2004-04-02 at 15:21, Andy Lutomirski wrote: > >>I agree in principle, but it would still be nice to have a simple way to >>have useful capabilities without setting up a MAC system. I don't see a >>capabilities fix adding any significant amount of code; it just takes >>some effort to get it right. > > > I'm not opposed to making the existing capability logic more useable; I > just think that capabilities will ultimately be superseded by TE. > > >>You can find my attempts to get it right in the >>linux-kernel archives, and I'll probably try to get something into 2.7 >>when it forks. With or without MAC, having a functioning capability >>system wouldn't hurt security. > > > Does revising the capability logic need to wait on 2.7? Have you > changed the logic significantly since the last patch you posted to lkml? > I don't _think_ it's changed, but I'll double-check that in a few days (I'm out of town). I'll also rediff my patch. Should it be a config option? Anyway, I have no strong objection to seeing a change in 2.6 -- there's just some risk that it could break something that depends on the current (broken, undocumented) behavior. Andrew: would you be willing to put a capabilities fix into -mm? --Andy - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||
| Last update: 2005-03-22 14:02 [from the cache] ©2003-2008 | |||||||||||