Messages in this thread | | | Date | Fri, 23 Apr 1999 12:30:14 +0200 | From | Pavel Machek <> | Subject | Re: inheritable set [was Re: caps in elf headers: use the sticky bit!] |
| |
Hi!
> >> No, because "more" wouldn't have any capabilities in its "inheritable" > >> set, so it would NOT inherit any capabilities which its parents had. > > > Thats not very compatible, right now if the parent has the caps they flow > > to their children. > > Right. That's the entire point: automatic inheritence of all caps is a > potential security problem, as it lets privileges leak into programs > which weren't designed to cope with those privs. You _can't_ change > that while maintaining compatibility. It's a simple one way choice:
Oh yes, I think I can. More is owned by root, anyway, so there's no problem lowering its priviledges with elf section. Yes, it requires root to go ahead and add elf section to more, but it is ok.
Pavel PS: What is hard is to force users to have _their_ executables with inheritable set set to zero... But it is _not_ problem for system executables like more.
-- The best software in life is free (not shareware)! Pavel GCM d? s-: !g p?:+ au- a--@ w+ v- C++@ UL+++ L++ N++ E++ W--- M- Y- R+
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |