Messages in this thread | | | Date | Tue, 26 May 2015 11:23:10 -0500 (CDT) | From | Christoph Lameter <> | Subject | Re: [PATCH v2 1/2] capabilities: Ambient capabilities |
| |
On Sat, 23 May 2015, Serge Hallyn wrote:
> > You cannot use pA to try to subvert a setuid, setgid, or file-capped > > program: if you execute any such program, pA gets cleared and the > > resulting evolution rules are unchanged by this patch. > > Christoph, just to be sure, is this ^ going to suffice for you? > > Seems like it should since any program which is setuid-root, i.e. > passwd, isn't likely to be designed to exec other programs.
Yes that should work.
| |