lkml.org 
[lkml]   [2008]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Frustrated with capabilities..
From
Date
On Thu, 2008-08-28 at 13:48 -0400, Theodore Tso wrote:
> On Thu, Aug 28, 2008 at 05:45:34PM +0300, Markku Savela wrote:
> >
> > > From: Pavel Machek <pavel@suse.cz>
> >
> > > Yes, you need upcoming filesystem capabilities. Binary may not
> > > inherit capabilities unless filesystem flags permit that.
> >
> > I think this is wrong. Normal executables inherit uid/gid and
> > supplementary groups by default. Why should capabilities be any
> > different?
>
> Well, because that's not the what the POSIX draft specification (and
> the rest of the Unix industry who were striving to meet the US
> Department of Defense's "B2 by '92" initiative) ended up implementing.

Minor nit. It was actually C2(Controlled Access Protection) by '92 which
is mainly just DAC protections as opposed to B2(Structured Protection)
which also included MAC policies and Sensitivity labels in addition to
DAC protections.

Dave



\
 
 \ /
  Last update: 2008-08-28 23:23    [W:0.101 / U:0.208 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site