Messages in this thread | | | Subject | Re: why are capabilities disabled? | From | Valdis.Kletnieks@vt ... | Date | Fri, 13 Feb 2004 13:08:57 -0500 |
| |
On Fri, 13 Feb 2004 18:54:53 +0100, =?ISO-8859-1?Q?Sven_K=F6hler?= said: > everybody's talking about filesystem-capabilities etc. > i still dream of starting a process with a certain capability.
As long as you're staying in the same domain of capabilities, there's no really big issue. The problem starts when you use fork(), exec(), and friends to launch something that may have a different set of capabilities (either more or less). Also note that exploited code can cause an exec() in a program that doesn't even have a call to exec() in it....
[unhandled content-type:application/pgp-signature] | |