Quoting Igor Zhbanov (izh1979@xxxxxxxxx): > But ordinary users can't create devices. It seems to me that in time > of implementation of capabilities in kernel 2.4, capabilities related > to filesystem was added first. And mark for them contains all above in > header file. And when CAP_MKNOD was added later, author just forget to > update mask. > > If mask was designed to drop all filesystem related capabilities, then > it must be expanded, because ordinary users cannot create devices etc. I think you thought Bruce was saying we shouldn't change the set of capabilities, but he was just asking exactly what changes Michael was interested in. Igor, thanks for finding this. I never got your original message. Do you have a patdch to add the two capabilities? Do you think the other two I mentioned (CAP_SYS_ADMIN and CAP_SETFCAP) need to be added too? I've added Andrew Morgan, LSM and SELinux mailing lists to get another opinion about adding those two. In particular, we'd be adding them to the fs_masks becuase CAP_SYS_ADMIN lets you change the selinux label, and CAP_SETFCAP lets you change the file capabilities. thanks, -serge -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
