![]() | |||||||||||||
Messages in this thread |
On Wed, Sep 06, 2006 at 01:25:31PM -0500, Serge E. Hallyn wrote: > The fact that you're changing the inheritance rules is a bit scary, so > I'm going to (and I hope others will) take some time to look it over. Thanks! I'd appreciate it. Don't hesitate to ask me if some decisions I made are unclear. I was about to write to you, in fact, since I wrote a version of my patch which merges with the one you made (an old version, though, I suppose: I took it from <URL: http://lkml.org/lkml/2006/8/15/294 >, but I can try merging with more recent versions). The point being to show that my patch is not incompatible with yours: they are quite complementary. (The merged patch can be found in <URL: ftp://quatramaran.ens.fr/pub/madore/newcaps/pre-alpha/ >.) > In the meantime, so long as you're adding some new capabilities, how > about also splitting up a few like CAP_SYS_ADMIN? Have you looked into > it and decided none are really separable, i.e. any subset leads to the > ability to get any other subset? I agree that splitting CAP_SYS_ADMIN might be worth while, but it really looks like opening a worm can, so I didn't feel up to the challenge there. It might be a good idea to reserve some bits for that possibility, however - I'm not sure how best to proceed. > I'd recommend you split this patch into at least 3: > 1. move to 64-bit caps > 2. introduce your new caps > (perhaps even one new cap per patch) > 3. introduce the new inheritance rules Yes, that sounds like a good idea. I'll do that. -- David A. Madore (david.madore@ens.fr, http://www.madore.org/~david/ ) - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2006-09-06 22:31 [from the cache] ©2003-2008 | |||||||||||||