Re: [PATCH] Add no_new_privs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 26/11/12 11:08, Karel Zak wrote:
>  I guess that there will be never one super util to set all the
>  possible properties (prlimit, personality, scheduler stuff, ....) and
>  I personally don't see problem to type
> 
>    setarch x86_64 --addr-no-randomize \
>    taskset --cpu-list 1,2 \
>    prlimit --nofile=1024:4095 \
>    nice -20 \
>    <myprog>

It may be a problem if the restrictions placed with one program are
incompatible with chaining another one.

For instance, I could want to run a static binary foo as:
 prlimit --nofile 1:1 /usr/local/bin/foo

But I won't be able to do
 prlimit --nofile 1:1 nice /usr/local/bin/foo
since nice wouldn't be able to open libc.

In this case nice can be called with prlimit as parameter, but you will
end up with some options provided by different binaries and which are
incompatible.

We probably can't avoid it, so go ahead with it. Make sure all these
tools have their man pages properly interlinked, though.

--
To unsubscribe from this list: send the line "unsubscribe util-linux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Netdev]     [Ethernet Bridging]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]

  Powered by Linux