Messages in this thread | | | Date | Sun, 9 Dec 2012 23:57:53 -0600 | From | Serge Hallyn <> | Subject | Re: [PATCH] Document how capability bits work |
| |
Quoting Rob Landley (rob@landley.net): > The fact that you need multiple sets of capabilities per process > (permitted, inheritable, effective), plus MORE sets (plural) of > capabilities attached to executable files, plus the "capability > bounding set" which is presumably so selinux can mess with it, plus
The bounding set was in large part a workaround for the absence of the user namespace (and, at the time, the devices cgroup).
(Now libcap-ng uses it to try and make capabilities generally easier to use.)
-serge
| |