Quoting Miklos Szeredi (miklos@xxxxxxxxxx): > > > Maybe sysctls just need to check capabilities, instead of uids. I > > > think that would make a lot of sense anyway. > > > > Would it be as simple as tagging the inodes with capability sets? One > > set for writing, or one each for reading and writing? > > Yes, or something even simpler, like mapping the owner permission bits > to CAP_SYS_ADMIN. There seem to be very few different permissions > under /proc/sys: > > --w------- > -r--r--r-- > -rw------- > -rw-r--r-- > > As long as the group and other bits are always the same, and we accept > that the owner bits really mean CAP_SYS_ADMIN and not something else, But I would assume some things under /proc/sys/net/ipv4 or /proc/sys/net/ath0 require CAP_NET_ADMIN rather than CAP_SYS_ADMIN? > then the permission check would not need to look at uids or gids at > all. > > Miklos > - > To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
