Messages in this thread | | | Date | Wed, 13 Feb 2008 00:58:23 +0300 | Subject | Re: [PATCH] exporting capability code/name pairs (try #4) | From | Alexey Dobriyan <> |
| |
On Tue, Feb 12, 2008 at 10:10:06AM +0900, Kohei KaiGai wrote: > Alexey Dobriyan wrote: > >On Fri, Feb 08, 2008 at 06:42:09PM +0900, Kohei KaiGai wrote: > >>[kaigai@saba ~]$ ls -R /sys/kernel/capability/ > >>/sys/kernel/capability/: > >>codes names version > >> > >>/sys/kernel/capability/codes: > >>0 10 12 14 16 18 2 21 23 25 27 29 30 32 4 6 8 > >>1 11 13 15 17 19 20 22 24 26 28 3 31 33 5 7 9 > >> > >>/sys/kernel/capability/names: > >>cap_audit_control cap_kill cap_net_raw cap_sys_nice > >>cap_audit_write cap_lease cap_setfcap cap_sys_pacct > >>cap_chown cap_linux_immutable cap_setgid cap_sys_ptrace > >>cap_dac_override cap_mac_admin cap_setpcap cap_sys_rawio > >>cap_dac_read_search cap_mac_override cap_setuid > >>cap_sys_resource > >>cap_fowner cap_mknod cap_sys_admin cap_sys_time > >>cap_fsetid cap_net_admin cap_sys_boot > >>cap_sys_tty_config > >>cap_ipc_lock cap_net_bind_service cap_sys_chroot > >>cap_ipc_owner cap_net_broadcast cap_sys_module > >>[kaigai@saba ~]$ cat /sys/kernel/capability/codes/20 > >>cap_sys_pacct > >>[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod > >>27 > >>[kaigai@saba ~]$ > >>-------------------------------------------------------- > >>Any comment please. > > > >You don't like 1 (one) /proc/capabilities, why? > > I have no preference whether a single /proc/capabilities, or the current > approach. > However, this idea requires a bit more cost to lookup a capability not > sequencially.
And I'm sure far less memory wasted at runtime.
Also, adding config option for one file/directory seems ridiculous to me. And changelog completely fails to mention why it is useful to lookup capabilities by name and number -- CAP_SYS_* numbers are part of ABI, they won't change.
| |