lkml.org 
[lkml]   [2004]   [Sep]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: (was: Re: PATCH: cdrecord: avoiding scsi device numbering for ide devices)
    John Myers <electronerd@monolith3d.com> wrote:

    > I hope this is not a stupid idea:
    >
    > I propose a finer-grained approach to suid-root binaries. Perhaps,
    > instead of having a single flag giving the binary all the rights and
    > responsibilities of its owner, there could be a table/list/something of
    > capabilities which we want to grant to the binary. This, of course,
    > would be a privileged operation (perhaps a new capability?).
    >
    > For example, we might want to grant cdrecord CAP_SYS_RAWIO. This way, we
    > don't have to worry about cdrecord running as root and not dropping all
    > the capabilities it doesn't need, by accident or by malice.

    cdrecord neither does drop the privileges by accident nor by malice.
    What I however see is that a completely unneeded incompatible interface change
    has been applied to a _stable_ Kernel.

    On a cleanly designed OS with fine grained permissions, a program like cdrecord
    does not need to worry about the permissions as it gets exactly the needed
    permissions granted by the execution environment.

    Jörg

    --
    EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin
    js@cs.tu-berlin.de (uni) If you don't have iso-8859-1
    schilling@fokus.fraunhofer.de (work) chars I am J"org Schilling
    URL: http://www.fokus.fraunhofer.de/usr/schilling ftp://ftp.berlios.de/pub/schily
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:05    [W:0.024 / U:31.244 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site