Messages in this thread | | | Subject | Re: [RFC][PATCH v3] Unprivileged: Disable raising of privileges | From | (Eric W. Biederman) | Date | Thu, 31 Dec 2009 10:41:08 -0800 |
| |
"Andrew G. Morgan" <morgan@kernel.org> writes:
> Since there is already independent support for disabling file > capabilities (the privilege escalation part), I see these two > mechanisms as separable.
I guess there is something that resembles support for disabling privilege escalation. The problem is that it requires privilege to use it.
I have no problem with expressing this in a fine grained manner internally to the kernel but the user space interface needs to be atomic so that we can enable this all without privilege.
Further I may be off but I think the implementation would be more challenging than what I have already posted. That doesn't mean it won't be more useful long term.
Eric
| |