Messages in this thread | | | Date | Sat, 03 Apr 2004 17:41:55 +0200 | From | Andy Lutomirski <> | Subject | Re: capabilitiescompute_cred |
| |
Stephen Smalley wrote:
> On Fri, 2004-04-02 at 15:21, Andy Lutomirski wrote: > >>I agree in principle, but it would still be nice to have a simple way to >>have useful capabilities without setting up a MAC system. I don't see a >>capabilities fix adding any significant amount of code; it just takes >>some effort to get it right. > > > I'm not opposed to making the existing capability logic more useable; I > just think that capabilities will ultimately be superseded by TE. > > >>You can find my attempts to get it right in the >>linux-kernel archives, and I'll probably try to get something into 2.7 >>when it forks. With or without MAC, having a functioning capability >>system wouldn't hurt security. > > > Does revising the capability logic need to wait on 2.7? Have you > changed the logic significantly since the last patch you posted to lkml? >
I don't _think_ it's changed, but I'll double-check that in a few days (I'm out of town). I'll also rediff my patch. Should it be a config option?
Anyway, I have no strong objection to seeing a change in 2.6 -- there's just some risk that it could break something that depends on the current (broken, undocumented) behavior.
Andrew: would you be willing to put a capabilities fix into -mm?
--Andy - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |