[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <48B744AE.5040606@kernel.org>
Date: Thu, 28 Aug 2008 17:37:02 -0700
From: "Andrew G. Morgan" <morgan@...nel.org>
To: Serge Hallyn <serue@...ibm.com>
CC: linux-kernel@...r.kernel.org, dhowells@...hat.com, agruen@...e.de
Subject: Re: [PATCH 2/2] file capabilities: turn on by default
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Acked-by: Andrew G. Morgan <morgan@...nel.org>
Cheers
Andrew
Serge Hallyn wrote:
| Now that file capabilities can be turned off at boot, go ahead
| and compile them into the kernel by default by making
| CONFIG_SECURITY_FILE_CAPABILITIES=y the default.
|
| Note that the boot flag no_file_caps must be specified to turn
| file capabilities off, as by default they are on. So the
| default behavior is in fact changed.
|
| Signed-off-by: Serge Hallyn <serue@...ibm.com>
| ---
| security/Kconfig | 7 +++++--
| 1 files changed, 5 insertions(+), 2 deletions(-)
|
| diff --git a/security/Kconfig b/security/Kconfig
| index 5592939..6fbb233 100644
| --- a/security/Kconfig
| +++ b/security/Kconfig
| @@ -75,12 +75,15 @@ config SECURITY_NETWORK_XFRM
|
| config SECURITY_FILE_CAPABILITIES
| bool "File POSIX Capabilities"
| - default n
| + default y
| help
| This enables filesystem capabilities, allowing you to give
| binaries a subset of root's powers without using setuid 0.
|
| - If in doubt, answer N.
| + You can still boot with the no_file_caps option to disable
| + file capabilities.
| +
| + If in doubt, answer Y.
|
| config SECURITY_ROOTPLUG
| bool "Root Plug Support"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFIt0Sp+bHCR3gb8jsRAmQuAKDXiLp/7hZ++JDxv1rL1kIVqS/YtgCeJIMk
zmPFh8NjFrUnElWyeF5R/Jo=
=AK55
-----END PGP SIGNATURE-----
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists