lkml.org 
[lkml]   [1998]   [Apr]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Securelevel bitmap patch
On Sun, Mar 29, 1998 at 09:17:08PM +0100, Alan Cox wrote:
> > In short, securelevels should be
> > (a) bitmaps
> > (b) per-process
>
> This is capabilities, this is NOT what BSD securelevels are. There was
> a Linux capabilities project. It never got merged, it died AFAIK.
>

It's not dead, it's just not being integrated mostly because of lack
of feedback. Linux-privs works. When 2.2 is out, I'll make a patch for
those interested in using it (I am :-) and hopefully it will get into
2.3 ASAP.

Linux-privs has both capabilities and a system-wide
"securebits". Securebits works as a filter which the per-process
filesystem-given ("suid") capabilities is filtered through. You can't
gain more capabilities than the system-wide "securebits" allow you. So
you can restrict the system just like BSD securelevel. However, the
mapping between "level" and bitmask will be a user-level policy.

astor

--
Alexander Kjeldaas, Guardian Networks AS, Trondheim, Norway
http://www.guardian.no/

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:3.677 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site