Messages in this thread | | | From | Christian Borntraeger <> | Subject | Re: request: capabilities that allow users to drop privileges further | Date | Mon, 15 Dec 2003 23:34:12 +0100 |
| |
Felix von Leitner wrote: > I would like to be able to drop capabilities that every normal user has, > so that network servers can limit the impact of possible future security > problems further. For example, I want my non-cgi web server to be able > to drop the capabilities to > > * fork > * execve > * ptrace > * load kernel modules > * mknod > * write to the file system
You can have a look at http://lsm.immunix.org/ and http://lsm.immunix.org/lsm_modules.html if there is something that fits your need. If not, feel free to write a security module, that is able to do just what you want. ;-)
cheers
Christian
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |