[lkml]   [2010]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: disablenetwork (v5): Require CAP_SETPCAP to enable
    On Sat, Jan 16, 2010 at 8:48 PM, Michael Stone <> wrote:
    > Andrew Morgan wrote:
    >> Please use CAP_NET_ADMIN for this feature (and add the corresponding
    >> comment in include/linux/capabilities.h).
    > Sure.
    > However, to make sure I understand the purpose of the adjustment, would you
    > mind saying a word or two about what considerations cause you to recommend
    > CAP_NET_ADMIN instead of (or in addition to?) CAP_SETPCAP?

    If you take a look at the capabilities.h file, you'll see that each of
    the capabilities is preceded by an explanation of what privilege it

    CAP_SETPCAP refers to privileged manipulation of capabilities
    (permission to violate the normal capability rules) and nothing to do
    with the network.

    You are adding something akin to a per-process tree firewall setting -
    deny/enable network access to this process. I think you'll agree that
    the CAP_NET_ADMIN description is a much better match for this.



    > Thanks for your feedback,
    > Michael

     \ /
      Last update: 2010-01-17 06:01    [W:0.024 / U:0.068 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site