Messages in this thread | | | From | "Serge E. Hallyn" <> | Subject | [PATCH 0/6] file capabilities cleanups: introduction | Date | Fri, 26 Sep 2008 22:27:44 -0400 |
| |
Following is a set of file capabilities cleanups. The first two patches are a repost of my previous patches which introduce a no_file_caps boot option, and remove the CONFIG_SECURITY_FILE_CAPABILITIES config option. The rest of the patches both clean up some of the capabilities code and reduce the kernel size (since enabling file capabilities grew it).
Andrew Morgan, if you have a moment, please do take a close look and make sure I'm not doing anything stupid/wrong in the cleanups! However ltp shows no difference with and without the patchset.
Following are the kernel sizes after some of the patches.
original, pre-patch, with file capabilities compiled out: text data bss dec hex filename 4188468 234432 316472 4739372 48512c vmlinux
original, pre-patch, with file capabilities compiled in: 4189356 234432 316472 4740260 4854a4 vmlinux
plain with fcaps always-on: 4189392 234456 316472 4740320 4854e0 vmlinux
with non-inline cap_safe_nice: 4189112 234456 316472 4740040 4853c8 vmlinux
with cleaned-up setcap: 4189120 234456 316472 4740048 4853d0 vmlinux
with needless check for target!=current removed from cap_capset: 4189104 234456 316472 4740032 4853c0 vmlinux
with needless(?) bprm_clear_caps calls removed: 4189088 234456 316472 4740016 4853b0 vmlinux
thanks, -serge
| |