On Fri, Apr 6, 2012 at 12:49, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote: > On Thu, 29 Mar 2012 15:01:46 -0500 > Will Drewry <wad@xxxxxxxxxxxx> wrote: >> From: Andy Lutomirski <luto@xxxxxxxxxxxxxx> >> With this set, a lot of dangerous operations (chroot, unshare, etc) >> become a lot less dangerous because there is no possibility of >> subverting privileged binaries. I don't want to derail things. So, tell me to go away, if I can't have what I want. Having said that, it would be great if NO_NEW_PRIVS also gave access to the restricted clone() flags. Such as CLONE_NEWIPC, CLONE_NEWNET and CLONE_NEWPID. Markus -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
