Hi!
> Pavel also mentioned that there's no way to prevent exec--I disagree
> (though I haven't looked at the list of capabilities in Linux or
> Posix, I'm afraid). Certainly, if you deny exec abilities you also
> want to deny, at least, the ability to mmap files as executable, and
> you also want to arrange that executable pages are never writable.
Right. But normal apps need ability to mmap as executable...
> And most importantly, the big thing that exec could do that mmap can't
> is get new capabilities by execing a setcap executable. (Sure, I can
> mmap su into myself. So what? I can't actually do anything with
> it!)
Yes, I forgot. You can easily deny exec of setuid programs.
Pavel
-- The best software in life is free (not shareware)! Pavel GCM d? s-: !g p?:+ au- a--@ w+ v- C++@ UL+++ L++ N++ E++ W--- M- Y- R+- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Wed Feb 23 2000 - 21:00:25 EST