Quoting Andrew G. Morgan (mor...@kernel.org): > I'm still missing something with the problem definition. > > So far if I follow the discussion we have determined that inheritance as > implemented is OK except for the fact that giving user an inheritable pI > bit which gives them default permission to use all binaries endowed with > the corresponding file fI bit.
There is another objection which ahs been raised, namely that it leaves too many tiny but crucial bits of security relevant information spread throughout the filesystem. This has also been said about using security.selinux xattrs. The answer as there could be a good set of tools to set and report the system wide state. In fact, libcap-ng provides such tools, to list the file capabilities throughout the system and capabilities in use by all running programs. -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
