[lkml]   [2004]   [Sep]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: (was: Re: PATCH: cdrecord: avoiding scsi device numbering for ide devices)
John Myers <> wrote:

> I hope this is not a stupid idea:
> I propose a finer-grained approach to suid-root binaries. Perhaps,
> instead of having a single flag giving the binary all the rights and
> responsibilities of its owner, there could be a table/list/something of
> capabilities which we want to grant to the binary. This, of course,
> would be a privileged operation (perhaps a new capability?).
> For example, we might want to grant cdrecord CAP_SYS_RAWIO. This way, we
> don't have to worry about cdrecord running as root and not dropping all
> the capabilities it doesn't need, by accident or by malice.

cdrecord neither does drop the privileges by accident nor by malice.
What I however see is that a completely unneeded incompatible interface change
has been applied to a _stable_ Kernel.

On a cleanly designed OS with fine grained permissions, a program like cdrecord
does not need to worry about the permissions as it gets exactly the needed
permissions granted by the execution environment.


-- (home) Jörg Schilling D-13353 Berlin (uni) If you don't have iso-8859-1 (work) chars I am J"org Schilling
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:05    [W:0.297 / U:10.244 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site