On Fri, Apr 24, 2015 at 10:53 AM, Serge Hallyn <serge.hallyn@xxxxxxxxxx> wrote: > Quoting Christoph Lameter (cl@xxxxxxxxx): >> On Thu, 9 Apr 2015, Christoph Lameter wrote: >> >> > > I'll submit a new version this week with the securebits. Sorry for the delay. >> > Are we going to get a new version? >> >> Replying to my own here. Cant we simply use the SETPCAP approach as per >> the patch I posted? > > Andy had objections to that, but it seems ok to me. > I object because CAP_SETPCAP is very powerful whereas CAP_NET_BIND_SERVICE, for example, isn't. I'm fine with having a switch to turn off ambient caps, but requiring the "on" state to give processes superpowers seems unfortunate. Sorry for the huge delay. I got caught up with travel and the merge window. Here's a sneak peek: https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/log/?h=cap_ambient I need to write the user code to go with it and test it a bit before sending it out for real. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
