RE: disable-cap-mlock

Chen, Kenneth W
2004-04-01T18:53:36Z

>>>>> Andrew Morton wrote on Thursday, April 01, 2004 10:34 AM
>
> If it's for access to SHM_HUGETLB

This is the main reason.

> then there was some discussion about
> extending the uid= thing to shm, but nothing happened. This could be
> resurrected.

We have tried doing that, in fact, I have worked on this on and off for
a while, none of the solutions we came up with are clean enough.

> I guess we could live with sysctl which simply nukes CAP_IPC_LOCK, but
> it has to be the when-all-else-failed option, yes?

Very much agreed, I also very much in agreement with wli that the user
level tool need a major improvement. These CAP_* hook has been in the
kernel for ages (since 2.4?), but the user land tool seems fossilized.
Last time I tried libcap (about two weeks ago), it segv on me.

- Ken