[lkml]   [2002]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Filesystem Capabilities in 2.6?
On Sun, 2002-11-03 at 06:46, Alexander Viro wrote:
> Quite so. Now, ability to _remove_ capabilities on exec() is a Good Thing(tm)
> regardless of suid. It can be combined with suid - that gives you something
> that is still evil, but less than it used to be. But I don't see any point
> in new independent mechanism for raising caps - e.g. since it assumes a
> bunch of new programs that were written to run with elevated caps and
> with assumption that they will be less dangerous than suid-root ones.
> Somehow, it doesn't make me happy about running such programs - not for
> first 5 years or so.

Removing capabilities is an easy thing to add. Firstly the binary can do
it anyway even on 2.4, secondly you can add an ELF property easily
enough which says which capabilities this gets if it is marked setuid

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:30    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean