> > Should a user be able to revoke a file descriptor opened by a root
> > processes in the first place?
>
> Maybe, especially if/when root ceases to mean anything special.
s/root/privileged process in the original comment
> I believe that the call is generally useful and should be made
> available to users, rather than being restricted to CAP_REVOKE
> or CAP_DAC_OVERRIDE.
I agree. I would, however, recommend that an initial revoke()
implementation restrict things to block/char devices. This will speed the
development of revoke() and increase the chances of being ready for 2.4.
In the meantime we can devote some more brainpower to the potential issues
of widening the scope to include files
Chris
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/