lkml.org 
[lkml]   [2011]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] System Wide Capability Bounding Set
From
Date
Eric Paris wrote:
> Not so long ago the global capability bounding set was removed from the
> kernel. Instead we created a new per task capability bounding set which
> was inherited by children.

An LSM module can provide ability to aggregate several tasks into a group
(called "security context" or "domain") and grant permissions against groups.
We can selectively grant whatever capabilities against groups.
Why do we need to get bothered by capability inheritance problem?


\
 
 \ /
  Last update: 2011-01-06 12:33    [W:0.175 / U:0.084 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site