Messages in this thread | | | From | Linus Torvalds <> | Date | Fri, 13 Jan 2012 13:13:06 -0800 | Subject | Re: [PATCH] Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs |
| |
On Fri, Jan 13, 2012 at 12:13 PM, Eric Paris <eparis@redhat.com> wrote: > > So you can't drop capabilities(7)? If you come in with permission you > can't get rid of it? Ouch.
I really don't understand why people get confused about this.
No, you can't drop capabilities. You're in a sandbox, the whole point is that you're running untrusted code, you had better not *have* any capabilities that you worry about dropping.
The whole "drop capabilities" is a red herring. If you think you need it, you're doing something wrong.
Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |