Re: [RFC PATCH 1/2] security, capabilities: create CAP_TRUSTED
"Serge E. Hallyn" <[email protected]>
| Newsgroups | gmane.comp.file-systems.jfs.general |
|---|---|
| Message-ID | <20171021160302.GA2842__43790.9424923875$1508644643$gmane$org@mail.hallyn.com> |
Quoting Nicolas Belouin ([email protected]): > with CAP_SYS_ADMIN being bloated, the usefulness of using it to > flag a process to be entrusted for e.g reading and writing trusted > xattr is near zero. > CAP_TRUSTED aims to provide userland with a way to mark a process as > entrusted to do specific (not specially admin-centered) actions. It > would for example allow a process to red/write the trusted xattrs. You say "for example". Are you intending to add more uses? If so, what are they? If not, how about renaming it CAP_TRUSTED_XATTR? What all does allowing writes to trusted xattrs give you? There are the overlayfs whiteouts, what else? ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot