| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 3 Nov 2006 14:00:11 -0600 From: "Serge E. Hallyn" <serue@...ibm.com> To: 20060906182719.GB24670@...gelap.austin.ibm.com Cc: serue@...ibm.com, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH 1/1] security: introduce fs caps Quoting chris friedhoff (chris@...edhoff.org): > The patch applies cleanly , compiles and runs smoothly against 2.6.18.1. > > I'm running slackware-current with a 2.6.18.1 kernel on an ext3 > filesystem. > > Background why I use the patch: > With 2.6.18 to create a tuntap interface CAP_NET_ADMIN is required. > Qemu uses tuntap to create a tap interface as a virtual net interface. > Instead now running qemu with root privileges to give it the right > to create a tap interface, i granted qemu with the help of the patch and > Kaigai Kohei's userspace tools the cap-net_admin capability. So qemu > runs again without root privilege but has now the right to create the > tap interface. > > Thanks for the patch. It reduces my the need of suid-bit progs. > It should be given a spin in -mm. One question is, if this were to be tested in -mm, do we want to keep this mutually exclusive from selinux through config, or should selinux stack on top of this? > I will document my experiences on http://www.friedhoff.org/fscaps.html Cool. thanks, -serge - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists