lkml.org 
[lkml]   [2012]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [RFC] Capabilities still can't be inherited by normal programs
From
On Mon, Dec 10, 2012 at 11:55 AM, Andy Lutomirski <luto@amacapital.net> wrote:
> Write a daemon. Rig up wrappers for each setuid program to instead
> call into that daemon and have that daemon invoke the privileged
> program on behalf of the caller, with a sanitized environment. Be
> annoyed by a few items on the "linux plumber's wish list" that make
> this rather difficult right now.

FWIW, this is something we'd like to do in Chrome OS. Dealing with
fs-attrs has traditionally been a pain, so this kind of simple passing
down of privilege would be much nicer. It means we'd have a
programmatic way to decide what privs a helper has, rather than having
to represent it in some way on-disk.

-Kees

--
Kees Cook
Chrome OS Security


\
 
 \ /
  Last update: 2012-12-10 21:41    [W:0.136 / U:0.144 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site