Messages in this thread | | | Date | Mon, 15 Dec 2003 14:48:09 -0800 | From | Chris Wright <> | Subject | Re: request: capabilities that allow users to drop privileges further |
| |
* Felix von Leitner (felix-kernel@fefe.de) wrote: > I would like to be able to drop capabilities that every normal user has, > so that network servers can limit the impact of possible future security > problems further. For example, I want my non-cgi web server to be able > to drop the capabilities to
Using existing capabilities system you can limit many of these. Just dropping privs from uid = 0 to anything else is a good start.
> * fork
rlimit
> * execve
mount fs noexec
> * ptrace
drop CAP_SYS_PTRACE
> * load kernel modules
drop CAP_SYS_MODULE
> * mknod
drop CAP_MKNOD
> * write to the file system
mount fs r/o.
In general, most of what you ask for is already there. Otherwise use some MAC policy that gives you the control you want (check out SELinux for example).
thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |