Messages in this thread | | | Date | Thu, 7 Sep 2006 19:34:49 +0200 | From | David Madore <> | Subject | Re: patch to make Linux capabilities into something useful (v 0.3.1) |
| |
On Thu, Sep 07, 2006 at 01:01:48AM +0000, Casey Schaufler wrote: > --- David Madore <david.madore@ens.fr> wrote: > > doesn't it make sense to implement them in the same > > framework? > > I'm certainly not convinced that you'd > want that. Think of all the programs that > would have to be marked with CAP_FORK.
They wouldn't have to be marked: capabilities are inherited by default, with my patch (as is the Unix tradition: euid=0 or {r,s}uid=0 are preserved upon execve()), normal processes have CAP_FORK and just pass it on if you don't do something special to remove it.
> > Rather > > than trying to reproduce the same rules in a > > different part of the > > kernel, causing code reduplication which would > > eventually, inevitably, > > fall out of sync... I think it's easier for > > everyone if under- and > > over-privileges are treated in a uniform fashion. > > This again assumes that you want to require > that in general processes run with some > capabilities.
Yes. In general, processes have all "regular" capabilities, and they are inherited normally.
-- David A. Madore (david.madore@ens.fr, http://www.madore.org/~david/ ) - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |