lkml.org 
[lkml]   [2002]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Filesystem Capabilities in 2.6?
From
Date
On Sun, 2002-11-03 at 06:46, Alexander Viro wrote:
> Quite so. Now, ability to _remove_ capabilities on exec() is a Good Thing(tm)
> regardless of suid. It can be combined with suid - that gives you something
> that is still evil, but less than it used to be. But I don't see any point
> in new independent mechanism for raising caps - e.g. since it assumes a
> bunch of new programs that were written to run with elevated caps and
> with assumption that they will be less dangerous than suid-root ones.
> Somehow, it doesn't make me happy about running such programs - not for
> first 5 years or so.

Removing capabilities is an easy thing to add. Firstly the binary can do
it anyway even on 2.4, secondly you can add an ELF property easily
enough which says which capabilities this gets if it is marked setuid

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:30    [W:0.578 / U:0.104 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site