[lkml]   [2000]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Capabilities

> Pavel also mentioned that there's no way to prevent exec--I disagree
> (though I haven't looked at the list of capabilities in Linux or
> Posix, I'm afraid). Certainly, if you deny exec abilities you also
> want to deny, at least, the ability to mmap files as executable, and
> you also want to arrange that executable pages are never writable.

Right. But normal apps need ability to mmap as executable...

> And most importantly, the big thing that exec could do that mmap can't
> is get new capabilities by execing a setcap executable. (Sure, I can
> mmap su into myself. So what? I can't actually do anything with
> it!)

Yes, I forgot. You can easily deny exec of setuid programs.
The best software in life is free (not shareware)! Pavel
GCM d? s-: !g p?:+ au- a--@ w+ v- C++@ UL+++ L++ N++ E++ W--- M- Y- R+

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:56    [W:0.093 / U:25.024 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site