Re: [PATCH] capabilities not inherited

[Lee Revell <rlrevell@joe-job.com>]

On Wed, 2005-06-08 at 14:59 -0700, Chris Wright wrote:
> * Alexander Nyberg (alexn@telia.com) wrote:
> > btw since the last discussion was about not changing the existing
> > interface and thus exposing security flaws, what about introducing
> > another prctrl that says maybe PRCTRL_ACROSS_EXECVE?
> 
> It's not ideal (as you mention, mess upon mess), but maybe it is the
> sanest way to go forward.
> 
> > Any new user-space applications must understand the implications of
> > using it so it's safe in that aspect. Yes?
> 
> At least less-likely to surprise ;-)

Any new user-space application developers that think about using
capabilities for anything should run away screaming.  When the JACK
developers proposed extending the mechanism to meet our needs, we were
basically told the capabilities subsystem is deeply broken and that we'd
have to rewrite the subsystem to do anything useful.  We ended up
shoehorning LSM and finally rlimits into doing what we need.  Please see
various "realtime LSM" threads for more (a LOT more) on the topic.

Lee