Messages in this thread | | | Subject | Re: [PATCH 3/4] security: capabilities patch (version 0.4.4), part 3/4: introduce new capabilities | From | Alan Cox <> | Date | Sun, 10 Sep 2006 17:23:13 +0100 |
| |
Ar Sul, 2006-09-10 am 15:42 +0200, ysgrifennodd David Madore: > Introduce six new "regular" (=on-by-default) capabilities: > > * CAP_REG_FORK, CAP_REG_OPEN, CAP_REG_EXEC allow access to the > fork(), open() and exec() syscalls,
CAP_REG_EXEC seems meaningless, I can do the same with mmap by hand for most types of binary execution except setuid (which is separate it seems)
Given the capability model is accepted as inferior to things like SELinux policies why do we actually want to fix this anyway. It's unfortunate we can't discard the existing capabilities model (which has flaws) as well really.
Alan
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |