On Thu, Jan 12, 2012 at 3:47 PM, Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > On Thu, Jan 12, 2012 at 3:38 PM, Will Drewry <wad@xxxxxxxxxxxx> wrote: >> This patch is a placeholder until Andy's (luto@xxxxxxx) patch arrives >> implementing Linus's proposal for applying a "this is a process that has >> *no* extra privileges at all, and can never get them". > > I think we can simplify and improve the naming/logic by just saying > "can't change privileges". > > I'd argue that that even includes "can't drop them", just to make it > really clear what the rules are. That may prevent another use: set this new flag, chroot, drop privileges, accept network connections. (The idea being that chroot might work unprivileged if this flag is set.) --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
