Re: [RFC] capabilities: Ambient capabilities

[Christoph Lameter]

On Fri, 24 Apr 2015, Serge Hallyn wrote:

> > I object because CAP_SETPCAP is very powerful whereas
> > CAP_NET_BIND_SERVICE, for example, isn't.  I'm fine with having a
> > switch to turn off ambient caps, but requiring the "on" state to give
>
> Would only really be needed for the initial 'enable ambient caps for this
> process tree', though.  Once that was set, add/remove'ing caps from the
> ambient set wouldn't need to be required.

Exactly. Its much simpler than alternate approaches. And its convoluted
enough.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/