lkml.org 
[lkml]   [2015]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: Kernel 4.3 breaks security in systems using capabilities
From
On Mon, Nov 2, 2015 at 10:38 AM, Richard Weinberger
<richard.weinberger@gmail.com> wrote:
>>
>> With the patch above, any process that is spawned by such a program will
>> inherit the raised capabilities if it has no own filecapabilities set.

Do you actually have a real example of this?

The ambient capabilities stay empty unless you explicitly raise them.
So your old workflow shouldn't actually have any change in it at all.

And if your old workflow gave a capability to something you don't
trust, and that then decides to now uses the ambient capabilities,
what does that change? It had the capability already.

So please explain what it is you actually object to. With actual real issues.

If behavior actually changed of existing setups, then that would be a
bug, and yes, it should be fixed. The new ambient capabilities should
only matter when you choose to use them.

Linus


\
 
 \ /
  Last update: 2015-11-02 20:21    [W:0.059 / U:2.144 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site