Messages in this thread | | | Date | Mon, 14 Feb 2011 15:45:46 -0500 | Subject | Re: [PATCH] System Wide Capability Bounding Set | From | Eric Paris <> |
| |
On Mon, Feb 7, 2011 at 9:55 PM, Eric Paris <eparis@redhat.com> wrote: > > Below is what I'm working on. I've asked dhowells to review the creds > code, since commit_creds() does not take const. Maybe that's just an > oversight. Basically I've exposed two new sysctls. > > /proc/sys/kernel/usermodehelper/bset > /proc/sys/kernel/usermodehelper/inheritable > > You must have CAP_SYS_MODULE to change these (changes are &= ONLY). > When the kernel launches a usermodehelper it will do so with these as > the bset and pI. I haven't attempted securebits and uid (since I didn't > really need them I don't think) But will if anyone can think of a use > case. > > Is this what you were thinking?
Anything? Problems with this patch/approach?
-Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |