lkml.org 
[lkml]   [1999]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] Capabilities, this time in elf section
Alexander Viro <viro@math.psu.edu> wrote:
> There is a *completely* userspace solution for such things. Teach
> sudo which capabilities it should leave. That's it. 'ask admin to mark
> executable' == be included into sudoers with appropriate set of
> capabilities. sudo allows different behaviour basing on a command, host,
> user and arguments of said command. And it leaves audit trail. No need to
> touch the kernel at all - tool already exists, so why reinvent the wheel?

[1] At the moment, sudo doesn't have to know to look into elf headers
to restrict what the program can do. It probably never will get this,
because that's outside the design concept of sudo.

[2] Scripts which use existing privileged executables would have to
be rewritten. [Or, are you suggesting that all those executables
get replaced with shell scripts that call sudo? This raises some
efficiency issues, and more backwards compatability issues.]

--
Raul

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.231 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site