[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 02 Feb 2015 14:05:16 -0500
From: Austin S Hemmelgarn <ahferroin7@...il.com>
To: Mimi Zohar <zohar@...ux.vnet.ibm.com>,
Serge Hallyn <serge.hallyn@...ntu.com>
CC: Casey Schaufler <casey@...aufler-ca.com>,
Christoph Lameter <cl@...ux.com>,
Serge Hallyn <serge.hallyn@...onical.com>,
Andy Lutomirski <luto@...capital.net>,
Jonathan Corbet <corbet@....net>,
Aaron Jones <aaronmdjones@...il.com>, Ted Ts'o <tytso@....edu>,
linux-security-module@...r.kernel.org,
linux-kernel@...r.kernel.org, akpm@...uxfoundation.org
Subject: Re: [capabilities] Allow normal inheritance for a configurable set
of capabilities
On 2015-02-02 13:47, Mimi Zohar wrote:
> On Mon, 2015-02-02 at 18:08 +0000, Serge Hallyn wrote:
>> Quoting Casey Schaufler (casey@...aufler-ca.com):
>>> I'm game to participate in such an effort. The POSIX scheme
>>> is workable, but given that it's 20 years old and hasn't
>>> developed real traction it's hard to call it successful.
>>
>> Over the years we've several times discussed possible reasons for this
>> and how to help. I personally think it's two things: 1. lack of
>> toolchain and fs support. The fact that we cannot to this day enable
>> ping using capabilities by default because of cpio, tar and non-xattr
>> filesystems is disheartening.
>
> We're working on resolving the CPIO issue. tar currently supports
> xattrs. At this point, how many non-xattr filesystems are there really?
>
FAT*, and UFS immediately come to mind, and I know of people who use UFS
for their root filesystem. There are a handful (ext* included) that
need an option turned on in the kernel config, and possibly also a mount
option added.
IIRC, the Linux NFS client has no xattr support, and that is very widely
used because it's easier to set up than any alternatives.
Download attachment "smime.p7s" of type "application/pkcs7-signature" (2455 bytes)
Powered by blists - more mailing lists