Re: disable-cap-mlock

Marc-Christian Petersen
2004-04-01T20:22:48Z

[-- Attachment #1: Type: text/plain, Size: 294 bytes --]

On Thursday 01 April 2004 21:26, William Lee Irwin III wrote:

Hi Bill,

> Okay, done.
> Misc fix thrown in: the policies beyond enabled/disabled were wrongly
> set up in minmax' args, so this throws the real max in the table.

Great. Works :) ... Prolly the attached one ontop.

ciao, Marc

[-- Attachment #2: sysctl_capable-Kconfig-update.patch --]
[-- Type: text/x-diff, Size: 684 bytes --]

--- old/security/Kconfig 2004-04-01 20:31:11.000000000 +0200
+++ new/security/Kconfig 2004-04-01 22:19:14.000000000 +0200
@@ -109,6 +109,19 @@ config SECURITY_CAPABILITY_SYSCTL
It's probably best to firewall the living daylights out
of anything using this also.

+ Anyway, the values are:
+
+ - 0 = checks enabled (the default)
+ - 1 = checks disabled
+ - 2 = root only
+ - 3 = no one, even root has no access to capabilities
+
+ All the sysctl entries are mutable until the "lockdown"
+ entry is set to a non-zero value. All capabilities are
+ enabled by default.
+
+ Say N unless you know what you are doing.
+
source security/selinux/Kconfig

endmenu