Re: capabilitiescompute_cred

[Stephen Smalley]

On Fri, 2004-04-02 at 15:21, Andy Lutomirski wrote:
> I agree in principle, but it would still be nice to have a simple way to 
> have useful capabilities without setting up a MAC system.  I don't see a 
> capabilities fix adding any significant amount of code; it just takes 
> some effort to get it right.

I'm not opposed to making the existing capability logic more useable; I
just think that capabilities will ultimately be superseded by TE.
 
> You can find my attempts to get it right in the 
> linux-kernel archives, and I'll probably try to get something into 2.7 
> when it forks.  With or without MAC, having a functioning capability 
> system wouldn't hurt security.

Does revising the capability logic need to wait on 2.7?  Have you
changed the logic significantly since the last patch you posted to lkml?

-- 
Stephen Smalley <sds@xxxxxxxxxxxxxx>
National Security Agency

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/