From: Paul Jackson <pj@sgi.com>
To: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: serue@us.ibm.com, linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/1] security: introduce fs caps
Date: Wed, 6 Sep 2006 23:40:29 -0700 [thread overview]
Message-ID: <20060906234029.a4b74c6f.pj@sgi.com> (raw)
In-Reply-To: <20060907012537.GA11138@sergelap.austin.ibm.com>
Serge wrote:
> With SECURITY_FS_CAPABILITIES=y, what changes is that it is possible for
> a binary to be marked as granting CAP_SYS_NICE to anyone running it.
Nice explanation - it almost made sense to me. Thanks.
Sounds like this patch would slightly increase the situations
under which a user task could do a cpuset attach_task on another
user task ... if it had CAP_SYS_NICE, or some such, it could gain
this attach_task ability that it had lacked on older kernels.
Sounds good to me.
My concern would be more if an existing user configuration stopped
working when these filesystem capabilities became available to them,
due to some previously ok operation becoming illegal.
As to exactly which CAP_SYS_* it is that has this power of
allowing a cpuset attach_task, I don't think I really care.
I'm happy.
--
I won't rest till it's the best ...
Programmer, Linux Scalability
Paul Jackson <pj@sgi.com> 1.925.600.0401
next prev parent reply other threads:[~2006-09-07 6:40 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-09-06 18:27 Serge E. Hallyn
2006-09-06 20:51 ` Paul Jackson
2006-09-07 1:25 ` Serge E. Hallyn
2006-09-07 6:40 ` Paul Jackson [this message]
2006-11-03 16:57 chris friedhoff
2006-11-03 20:00 ` Serge E. Hallyn
2006-11-03 20:29 ` Stephen Smalley
2006-11-03 20:47 ` Serge E. Hallyn
2006-11-04 2:08 ` Kyle Moffett
2006-11-04 4:12 ` James Morris
2006-11-06 13:31 ` Stephen Smalley
2006-11-08 22:24 Serge E. Hallyn
2006-11-08 22:48 ` Alexey Dobriyan
2006-11-08 23:52 ` Serge E. Hallyn
2006-11-09 5:27 ` Alexey Dobriyan
2006-11-09 6:17 ` Serge E. Hallyn
2006-11-13 16:43 ` Serge E. Hallyn
2006-11-13 21:04 ` Alexey Dobriyan
2006-11-14 3:01 ` Serge E. Hallyn
2006-11-09 6:10 ` Serge E. Hallyn
2006-11-09 9:33 ` Chris Friedhoff
2006-11-09 14:50 ` Bill O'Donnell
2006-11-13 21:57 ` Bill O'Donnell
2006-11-14 5:25 ` Serge E. Hallyn
2006-11-14 13:55 ` Bill O'Donnell
2006-11-14 15:23 ` Serge E. Hallyn
2006-11-14 17:28 ` Chris Friedhoff
2006-11-14 17:40 ` Bill O'Donnell
2006-11-15 12:08 ` KaiGai Kohei
2006-11-15 17:06 ` Bill O'Donnell
2006-11-15 21:49 ` Chris Friedhoff
2006-11-16 14:47 ` Bill O'Donnell
2006-11-17 18:37 ` Chris Friedhoff
2006-11-17 19:12 ` Chris Friedhoff
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060906234029.a4b74c6f.pj@sgi.com \
--to=pj@sgi.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serue@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome