> > Maybe sysctls just need to check capabilities, instead of uids. I > > think that would make a lot of sense anyway. > > Would it be as simple as tagging the inodes with capability sets? One > set for writing, or one each for reading and writing? Yes, or something even simpler, like mapping the owner permission bits to CAP_SYS_ADMIN. There seem to be very few different permissions under /proc/sys: --w------- -r--r--r-- -rw------- -rw-r--r-- As long as the group and other bits are always the same, and we accept that the owner bits really mean CAP_SYS_ADMIN and not something else, then the permission check would not need to look at uids or gids at all. Miklos - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
