linux-kernel - Re: [PATCH 0/3] Enable namespaced file capabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170623183955.GD21137@mail.hallyn.com>
Date:   Fri, 23 Jun 2017 13:39:55 -0500
From:   "Serge E. Hallyn" <serge@...lyn.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     James Bottomley <James.Bottomley@...senPartnership.com>,
        "Serge E. Hallyn" <serge@...lyn.com>, zohar@...ux.vnet.ibm.com,
        containers@...ts.linux-foundation.org,
        linux-kernel@...r.kernel.org, xiaolong.ye@...el.com,
        linux-security-module@...r.kernel.org, lkp@...org
Subject: Re: [PATCH 0/3] Enable namespaced file capabilities

Quoting Eric W. Biederman (ebiederm@...ssion.com):
> Even with one xattr of any type there is something appealing about
> putting the logic that limits that xattr to a namespace in the name.  As

Exactly.  That's the idea - from Stefan - that I thought was a worthwhile
improvement over my own previous patch, which puts the logic in the value.
Most of the complaints raised so far about this patchset are just as valid (or
invalid) against my previous patch, but I was particularly interested in
thoughts on this approach versus mine.

thanks,
-serge