>> To expand on this a little, some of the capabilities you are looking to
>> add are of very little if any use without being able to specify objects.
>> For example, CAP_REG_OPEN is whether the process can open any file
>> instead of specific ones. How many applications open no files whatsoever
>> in practice? Even if there are some as soon as they change and need to
>> open a file they'll need this capability and will be able to open any.
>> CAP_REG_WRITE has the same problem. For a description of why
>> CAP_REG_EXEC is meaningless see the digsig thread on the LSM list from
>> earlier this year.
>
>CAP_REG_OPEN and CAP_REG_EXEC might be useful only for demonstration
>purposes, but I've *often* wished I could run a program without
You cannot reasonable run a program without CAP_REG_OPEN, because
ld.so, libc.so and libdl.so all may load a ton of required files
underneath you.
$ strace -e open ls 2>&1 >/dev/null | grep open | wc -l
36
Jan Engelhardt
--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
