Re: disablenetwork (v5): Require CAP_SETPCAP to enable

[Andrew G. Morgan]

On Sat, Jan 16, 2010 at 8:48 PM, Michael Stone <michael@xxxxxxxxxx> wrote:
> Andrew Morgan wrote:
>>
>> Please use CAP_NET_ADMIN for this feature (and add the corresponding
>> comment in include/linux/capabilities.h).
>
> Sure.
> However, to make sure I understand the purpose of the adjustment, would you
> mind saying a word or two about what considerations cause you to recommend
> CAP_NET_ADMIN instead of (or in addition to?) CAP_SETPCAP?

If you take a look at the capabilities.h file, you'll see that each of
the capabilities is preceded by an explanation of what privilege it
enables.

CAP_SETPCAP refers to privileged manipulation of capabilities
(permission to violate the normal capability rules) and nothing to do
with the network.

You are adding something akin to a per-process tree firewall setting -
deny/enable network access to this process. I think you'll agree that
the CAP_NET_ADMIN description is a much better match for this.

Cheers

Andrew

>
> Thanks for your feedback,
>
> Michael
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/