Re: [RFC] Capabilities still can't be inherited by normal programs

[Serge Hallyn]

Quoting Andrew G. Morgan (morgan@xxxxxxxxxx):
> I'm still missing something with the problem definition.
> 
> So far if I follow the discussion we have determined that inheritance as
> implemented is OK except for the fact that giving user an inheritable pI
> bit which gives them default permission to use all binaries endowed with
> the corresponding file fI bit.

There is another objection which ahs been raised, namely that it leaves too
many tiny but crucial bits of security relevant information spread throughout
the filesystem.

This has also been said about using security.selinux xattrs.  The answer as
there could be a good set of tools to set and report the system wide state.
In fact, libcap-ng provides such tools, to list the file capabilities
throughout the system and capabilities in use by all running programs.

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/