From: "Andrew G. Morgan" <morgan@kernel.org>
To: "Ismail Dönmez" <ismail@pardus.org.tr>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Linux Security Modules List
<linux-security-module@vger.kernel.org>,
linux-kernel@vger.kernel.org,
"Serge E. Hallyn" <serue@us.ibm.com>
Subject: Re: [PATCH] per-process securebits
Date: Sun, 03 Feb 2008 17:10:53 -0800 [thread overview]
Message-ID: <47A6661D.7020305@kernel.org> (raw)
In-Reply-To: <200802040254.50444.ismail@pardus.org.tr>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Ismail Dönmez wrote:
| What I meant to ask was what does "per-process securebits" brings as
extra.
It allows you to create a legacy free process tree. For example, a
chroot, or container (which Serge can obviously explain in more detail),
environment in which root has no privilege at all. One in which
privilege comes only from filesystem capabilities.
| FWIW in Pardus 2008 we'll enable Posix file capabilities by default so
people
| could "harden" their setups.
Cheers
Andrew
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQFHpmYd+bHCR3gb8jsRAlDHAJ9RvFRieU2eUPJUHh7K84NMLmytTQCgupfS
KxdoXz400AeMWJiaikGH9U8=
=yx8I
-----END PGP SIGNATURE-----
next prev parent reply other threads:[~2008-02-04 1:11 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-02-01 8:11 [PATCH] per-process securebits Andrew G. Morgan
2008-02-01 8:28 ` Andrew Morton
2008-02-01 9:07 ` James Morris
2008-02-04 18:17 ` Pavel Machek
2008-02-04 22:00 ` Andrew Morton
2008-02-03 6:01 ` Andrew G. Morgan
2008-02-03 6:18 ` Andrew Morton
2008-02-03 6:25 ` Ismail Dönmez
2008-02-04 0:49 ` Andrew G. Morgan
2008-02-04 0:54 ` Ismail Dönmez
2008-02-04 1:10 ` Andrew G. Morgan [this message]
2008-02-04 16:45 ` Serge E. Hallyn
2008-02-05 1:15 ` Ismail Dönmez
2008-02-01 20:15 ` serge
2008-02-03 6:11 ` Andrew G. Morgan
2008-02-05 18:46 ` Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=47A6661D.7020305@kernel.org \
--to=morgan@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=ismail@pardus.org.tr \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serue@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.