![]() | |||||||||||||
Messages in this thread |
Andy Lutomirski <luto@myrealbox.com> writes: > I'm not convinced that Posix's version makes any sense. Also, there are > apparently a number of drafts around which disagree on what the right > rules are. (My copy, for example, matches the old rules exactly, but > the old rules caused the sendmail problem.) Don't confuse POSIX _semantics_ with implementation _bugs_. > And, under Posix, what does > the inheritable mask mean, anyway? > > Also, I don't find the posix rules to be useful (why is there an > inheritable mask if all it does is to cause caps to be dropped on > exec, when the user could just manually drop them?). You can use the inheritable set, if you want to give capabilities to a process when it's started by an already priviledged parent (e.g. a root process), but not when it's started by a regular user. See <http://www.olafdietsche.de/linux/capability/> for an example. Regards, Olaf. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-03-22 13:03 [from the cache] ©2003-2008 | |||||||||||||