lkml.org 
[lkml]   [2008]   [Sep]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 2/2] file capabilities: turn on by default
On Mon, 22 Sep 2008 13:49:01 -0500 Serge E. Hallyn wrote:

>
> Now that file capabilities can be turned off at boot, go ahead
> and compile them into the kernel by default by making
> CONFIG_SECURITY_FILE_CAPABILITIES=y the default.

Hi,

How much code does this add to everyone's kernel?

> Note that the boot flag no_file_caps must be specified to turn
> file capabilities off, as by default they are on. So the
> default behavior is in fact changed.

If most people want this enable, using 'no_file_caps' makes
some sense. OTOH, if most people don't want/use it, then
having a 'file_caps_on' option would make more sense.

Do you have any (unbiased :) ideas about this?

Thanks.

> Signed-off-by: Serge Hallyn <serue@us.ibm.com>
> Acked-by: Andrew G. Morgan <morgan@kernel.org>
> ---
> security/Kconfig | 7 +++++--
> 1 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/security/Kconfig b/security/Kconfig
> index 5592939..6fbb233 100644
> --- a/security/Kconfig
> +++ b/security/Kconfig
> @@ -75,12 +75,15 @@ config SECURITY_NETWORK_XFRM
>
> config SECURITY_FILE_CAPABILITIES
> bool "File POSIX Capabilities"
> - default n
> + default y
> help
> This enables filesystem capabilities, allowing you to give
> binaries a subset of root's powers without using setuid 0.
>
> - If in doubt, answer N.
> + You can still boot with the no_file_caps option to disable
> + file capabilities.
> +
> + If in doubt, answer Y.
>
> config SECURITY_ROOTPLUG
> bool "Root Plug Support"


---
~Randy


\
 
 \ /
  Last update: 2008-09-22 21:07    [W:0.349 / U:0.208 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site