lkml.org 
[lkml]   [1999]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: inheritable set [was Re: caps in elf headers: use the sticky bit!]
Hi!

> >> No, because "more" wouldn't have any capabilities in its "inheritable"
> >> set, so it would NOT inherit any capabilities which its parents had.
>
> > Thats not very compatible, right now if the parent has the caps they flow
> > to their children.
>
> Right. That's the entire point: automatic inheritence of all caps is a
> potential security problem, as it lets privileges leak into programs
> which weren't designed to cope with those privs. You _can't_ change
> that while maintaining compatibility. It's a simple one way choice:

Oh yes, I think I can. More is owned by root, anyway, so there's no
problem lowering its priviledges with elf section. Yes, it requires
root to go ahead and add elf section to more, but it is ok.

Pavel
PS: What is hard is to force users to have _their_ executables with
inheritable set set to zero... But it is _not_ problem for system
executables like more.

--
The best software in life is free (not shareware)! Pavel
GCM d? s-: !g p?:+ au- a--@ w+ v- C++@ UL+++ L++ N++ E++ W--- M- Y- R+

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.079 / U:1.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site