> >> No, because "more" wouldn't have any capabilities in its "inheritable"
> >> set, so it would NOT inherit any capabilities which its parents had.
>
> > Thats not very compatible, right now if the parent has the caps they flow
> > to their children.
>
> Right. That's the entire point: automatic inheritence of all caps is a
> potential security problem, as it lets privileges leak into programs
> which weren't designed to cope with those privs. You _can't_ change
> that while maintaining compatibility. It's a simple one way choice:
Oh yes, I think I can. More is owned by root, anyway, so there's no
problem lowering its priviledges with elf section. Yes, it requires
root to go ahead and add elf section to more, but it is ok.
Pavel
PS: What is hard is to force users to have _their_ executables with
inheritable set set to zero... But it is _not_ problem for system
executables like more.
-- The best software in life is free (not shareware)! Pavel GCM d? s-: !g p?:+ au- a--@ w+ v- C++@ UL+++ L++ N++ E++ W--- M- Y- R+- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/