Re: [PATCH] [request for inclusion] Realtime LSM

Jack O'Quin
2005-01-07T19:57:17Z

Martin Mares <mj@ucw.cz> writes:

>> Yes, SETPCAP became a gaping security hole. Recall the sendmail hole.
>
> Hmmm, I don't remember now, could you give me some pointer, please?

I already did that...

> Jack O'Quin wrote:
> > The biggest problem was CAP_SETPCAP, which for good reasons[1] is
> > disabled in distributed kernels. This forced every user to patch and
> > build a custom kernel. Worse, it opened all our systems up to the
> > problems reported by this sendmail security advisory.

[1] http://www.securiteam.com/unixfocus/5KQ040A1RI.html

--
joq