Messages in this thread | | | Date | Thu, 8 Apr 1999 20:54:57 -0400 (EDT) | From | "Albert D. Cahalan" <> | Subject | Re: ext3 to include capabilities? |
| |
Andreas Siegert writes: > Quoting Albert D. Cahalan (acahalan@cs.uml.edu):
>> I'm still waiting for a filesystem-based proposal that works with NFS. > > Capabilities are there to increase security. Anyone who seriously > wants security will not use NFS.
I keep hearing this without a reason. Assuming you filter incoming packets and don't allow random insecure machines on your network, just how is NFS insecure? You'd have to attack it with some kind of multi-machine hard link race condition I think. (but inode generation numbers might seal that too)
> Breaking other tools like tar and friends I see as a serious issue, > but NFS, never. But when introducing capabilities and ACLs one will > need new archival programs that take care of them anyway. Anything > that does not support them directly will probably end up as a tool > to break them.
With ACLs, stuff does break a bit.
Capabilities are no problem though, as long as you keep them out of the filesystem. The executable header method won't break with tar.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |