Messages in this thread | | | From | Andy Lutomirski <> | Date | Sat, 14 Mar 2015 15:55:24 -0700 | Subject | Re: [RFC] capabilities: Ambient capabilities |
| |
It occurs to me that my previous reply was unnecessarily long and missed the point. Trying again:
On Sat, Mar 14, 2015 at 3:17 PM, Andrew G. Morgan <morgan@kernel.org> wrote: > On Sat, Mar 14, 2015 at 2:45 PM, Andy Lutomirski <luto@amacapital.net> wrote: >> On Sat, Mar 14, 2015 at 2:09 PM, Andrew G. Morgan <morgan@kernel.org> wrote: >>> My Nack remains that you are eliminating the explicit enforcement of >>> selective inheritance. A lockable secure bit protecting access to your >>> prctl() function would address this concern. >> >> Would a sysctl or securebit that *optionally* allows pA to be disabled >> satisfy you?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It would be kind of nice to remove your nack. I think that the above is the relevant question. Could you answer it?
--Andy
| |