Messages in this thread | | | Date | Mon, 14 Feb 2011 15:24:53 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH] System Wide Capability Bounding Set |
| |
Quoting Eric Paris (eparis@parisplace.org): > On Mon, Feb 7, 2011 at 9:55 PM, Eric Paris <eparis@redhat.com> wrote: > > > > Below is what I'm working on. I've asked dhowells to review the creds > > code, since commit_creds() does not take const. Maybe that's just an > > oversight. Basically I've exposed two new sysctls. > > > > /proc/sys/kernel/usermodehelper/bset > > /proc/sys/kernel/usermodehelper/inheritable > > > > You must have CAP_SYS_MODULE to change these (changes are &= ONLY). > > When the kernel launches a usermodehelper it will do so with these as > > the bset and pI. I haven't attempted securebits and uid (since I didn't > > really need them I don't think) But will if anyone can think of a use > > case. > > > > Is this what you were thinking? > > > Anything? Problems with this patch/approach?
Sorry, I've just not had a chance to take a close enough look. I'll try to do so tonight.
-serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |