Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756104AbbBHJFd (ORCPT ); Sun, 8 Feb 2015 04:05:33 -0500 Received: from mail-ob0-f181.google.com ([209.85.214.181]:45246 "EHLO mail-ob0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755359AbbBHJF0 (ORCPT ); Sun, 8 Feb 2015 04:05:26 -0500 MIME-Version: 1.0 In-Reply-To: References: <20150206000356.GA11758@winterfell> Date: Sun, 8 Feb 2015 10:05:25 +0100 X-Google-Sender-Auth: oUmd3TvA5Uux8Yt_gcRLB0uNRAM Message-ID: Subject: Re: [PATCH v3] kernel: Conditionally support non-root users, groups and capabilities From: Geert Uytterhoeven To: Iulia Manda Cc: One Thousand Gnomes , Josh Triplett , Paul McKenney , Peter Zijlstra , Michal Hocko , Andrew Morton , "linux-kernel@vger.kernel.org" , Serge Hallyn , Darren Hart , Tim Bird Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2162 Lines: 62 Hi Iulia, On Fri, Feb 6, 2015 at 2:10 PM, Iulia Manda wrote: > On 6 February 2015 at 02:03, Iulia Manda wrote: >> There are a lot of embedded systems that run most or all of their functionality >> in init, running as root:root. For these systems, supporting multiple users is >> not necessary. >> >> This patch adds a new symbol, CONFIG_MULTIUSER, that makes support for non-root >> users, non-root groups, and capabilities optional. It is enabled under >> CONFIG_EXPERT menu. >> >> When this symbol is not defined, UID and GID are zero in any possible case >> and processes always have all capabilities. >> >> The following syscalls are compiled out: setuid, setregid, setgid, >> setreuid, setresuid, getresuid, setresgid, getresgid, setgroups, getgroups, >> setfsuid, setfsgid, capget, capset. >> >> Also, groups.c is compiled out completely. >> >> This change saves about 25 KB on a defconfig build. >> >> The kernel was booted in Qemu. All the common functionalities work. Adding >> users/groups is not possible, failing with -ENOSYS. >> >> Bloat-o-meter output: >> add/remove: 7/87 grow/shrink: 19/397 up/down: 1675/-26325 (-24650) >> > > Forgot to add: > > Signed-off-by: Iulia Manda > Reviewed-by: Josh Triplett > >> --- >> Changes since v2: >> - rename symbol; >> - make SECURITY dependent on MULTIUSER >> > > + make symbols depend on MULTIUSER instead of selecting it. Thanks for the update! Acked-by: Geert Uytterhoeven Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/