(please do not drop Cc, or I would have lost this thread part if I had not been on lkml. And sometimes I am not because of the volume. Thanks.)
On Oct 30 2007 15:13, Peter Dolding wrote: >On 10/30/07, Crispin Cowan <[EMAIL PROTECTED]> wrote: > >> * I have no clue what family to put MultiADM or Dazuko into > >MultiADMIN falls under o my god head ache. This is more a posix >standard feature altered ie 1 root user turned into many. This really >risks breaking the other models as a LSM. I disagree. Traditionally, Linux has given a process all capabilities when the UID changed to 0 (either by setuid(2) or executing a SUID binary). This has been relieved over the years, and right now with LSMs in the field, it is possible to 'deactivate' this special case for UID 0. SELinux does not have this special case for UID 0. Neither does it seem to use capabilities (quick grep through the source). So basically, all users are the same, and no one has capabilities by default. Does SELinux thus break with other LSMs? Now assume a SELinux system where all users have all capabilities (and the policy that is in place restricts the use of these capabilities then) -- should not be that unlikely. Does that break with other LSMs? - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
