Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751958AbWIGUFq (ORCPT ); Thu, 7 Sep 2006 16:05:46 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751959AbWIGUFq (ORCPT ); Thu, 7 Sep 2006 16:05:46 -0400 Received: from code.and.org ([65.172.155.230]:42447 "EHLO mail.and.org") by vger.kernel.org with ESMTP id S1751958AbWIGUFp (ORCPT ); Thu, 7 Sep 2006 16:05:45 -0400 To: Kyle Moffett Cc: David Madore , Linux Kernel mailing-list From: James Antill References: <20060905212643.GA13613@clipper.ens.fr>

Content-Type: text/plain; charset=US-ASCII Date: Thu, 07 Sep 2006 16:05:40 -0400 In-Reply-To: (Kyle Moffett's message of "Thu, 7 Sep 2006 14:33:56 -0400") Message-ID: User-Agent: Gnus/5.1007 (Gnus v5.10.7) XEmacs/21.4.19 (linux) MIME-Version: 1.0 X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: james@mail.and.org Subject: Re: patch to make Linux capabilities into something useful (v 0.3.1) X-SA-Exim-Version: 4.2 (built Tue, 02 May 2006 07:36:10 -0400) X-SA-Exim-Scanned: Yes (on mail.and.org) Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1360 Lines: 34 Kyle Moffett writes: > On Sep 07, 2006, at 14:21:15, James Antill wrote: >> >> Just a minor comment, can you break out the OPEN into at least >> OPEN_R, OPEN_NONFILE_W and OPEN_W (possibly OPEN_A, but I don't >> want that personally). The case I'm thinking about are network >> daemons that need to open+write to the syslog socket but only have >> read access elsewhere. >> >> Also there is much more than just bind9 using capabilities, the >> obvious ones that come to mind are NOATIME and AUDIT. > > To be honest, once you get to the point of having an OPEN_NONFILE_W > capability you should really just be using SELinux. Actually, I got confused ... I forgot that you have to connect() to /dev/log and can't just open() it[1] ... so just having open_r and open_w separated would be enough. Which you'll hopefully agree would be nice to have outside of SELinux policy (noting that SELinux doesn't let you limit open calls, as such, only read+write -- although it's mostly the same). [1] Although, if we ever fix open... :) -- James Antill -- james@and.org http://www.and.org/and-httpd - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/