Re: [PATCH] capabilities not inherited

[Chris Wright]

* Alexander Nyberg (alexn@xxxxxxxxx) wrote:
> btw since the last discussion was about not changing the existing
> interface and thus exposing security flaws, what about introducing
> another prctrl that says maybe PRCTRL_ACROSS_EXECVE?

It's not ideal (as you mention, mess upon mess), but maybe it is the
sanest way to go forward.

> Any new user-space applications must understand the implications of
> using it so it's safe in that aspect. Yes?

At least less-likely to surprise ;-)

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/