Messages in this thread | | | Date | Mon, 15 Dec 2003 22:39:12 +0100 | From | Felix von Leitner <> | Subject | request: capabilities that allow users to drop privileges further |
| |
I would like to be able to drop capabilities that every normal user has, so that network servers can limit the impact of possible future security problems further. For example, I want my non-cgi web server to be able to drop the capabilities to
* fork * execve * ptrace * load kernel modules * mknod * write to the file system
and I would like to modify my smtpd to not be able to
* fork * execve * ptrace * load kernel modules * mknod
I can kludge around some of these, for example I can disable fork with resource limits, and I can limit writing to the file system with chroot and proper permissions in the file systems, but I'm not aware of a way to disable ptrace for example, or pthread_create.
I know that there are patches to provide an extended "jail" chroot support, but being able to drop capabilities like this would be a more general solution.
Felix - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |