lkml.org 
[lkml]   [2015]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [RFC] capabilities: Ambient capabilities
On Fri, Apr 24, 2015 at 1:13 PM, Christoph Lameter <cl@linux.com> wrote:
> On Fri, 24 Apr 2015, Andy Lutomirski wrote:
>
>> That's sort of what my patch does -- you need CAP_SETPCAP to switch
>> the securebit.
>>
>> But Christoph's patch required it to add caps to the ambient set, right?
>
> Yes but you seem to be just adding one additional step without too much of
> a benefit because you still need CAP_SETPCAP.
>

No, because I set the default to on :)

Also, in my model you can do:

$ sudo capset cap_whatever=eip something
$ ./something

and the program can make its cap be ambient and run a helper. In the
CAP_SETPCAP model, that doesn't work.

--Andy

--
Andy Lutomirski
AMA Capital Management, LLC


\
 
 \ /
  Last update: 2015-04-24 22:41    [W:0.091 / U:0.400 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site