From mboxrd@z Thu Jan 1 00:00:00 1970 From: Serge Hallyn Subject: Re: [RFC] capabilities: Ambient capabilities Date: Sat, 25 Apr 2015 02:45:36 +0000 Message-ID: <20150425024536.GA23915@ubuntumail> References: <20150424175348.GL16377@ubuntumail> <20150424190935.GN16377@ubuntumail> <20150424211511.GB28613@mail.hallyn.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Andy Lutomirski Cc: "Serge E. Hallyn" , Jarkko Sakkinen , Ted Ts'o , "Andrew G. Morgan" , Andrew Morton , Michael Kerrisk , Mimi Zohar , Linux API , Austin S Hemmelgarn , linux-security-module , Aaron Jones , Christoph Lameter , LKML , Serge Hallyn , Markku Savela , Kees Cook , Jonathan Corbet List-Id: linux-api@vger.kernel.org Quoting Andy Lutomirski (luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org): > On Apr 24, 2015 2:15 PM, "Serge E. Hallyn" wrote: > > > > On Fri, Apr 24, 2015 at 01:18:44PM -0700, Andy Lutomirski wrote: > > > On Fri, Apr 24, 2015 at 1:13 PM, Christoph Lameter wrote: > > > > On Fri, 24 Apr 2015, Andy Lutomirski wrote: > > > > > > > >> That's sort of what my patch does -- you need CAP_SETPCAP to switch > > > >> the securebit. > > > >> > > > >> But Christoph's patch required it to add caps to the ambient set, right? > > > > > > > > Yes but you seem to be just adding one additional step without too much of > > > > a benefit because you still need CAP_SETPCAP. > > > > > > > > > > No, because I set the default to on :) > > > > Right - I definately prefer > > > > . default off > > . CAP_SETPCAP required to turn it on (for self and children) > > . once on, anyone can copy bits from (whatever we decided) to pA. > > > > Why default off? If there's some weird reason that switching it on > could cause a security problem, then I'd agree, but I haven't spotted > a reason yet. Cause it's less scary? I'll just wait for the new patchset :)