Messages in this thread | | | Subject | Re: [PATCH] System Wide Capability Bounding Set | From | Tetsuo Handa <> | Date | Thu, 6 Jan 2011 20:30:24 +0900 |
| |
Eric Paris wrote: > Not so long ago the global capability bounding set was removed from the > kernel. Instead we created a new per task capability bounding set which > was inherited by children.
An LSM module can provide ability to aggregate several tasks into a group (called "security context" or "domain") and grant permissions against groups. We can selectively grant whatever capabilities against groups. Why do we need to get bothered by capability inheritance problem?
| |