linux-kernel - Re: [PATCH 0/3] Introduce user namespace capabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lkgjtvvbhiaern2fkcsholu4yaypsykfdpxim3k3mug2oko5iq@hoyossca24y5>
Date: Fri, 17 May 2024 03:00:58 -0700
From: Jonathan Calmels <jcalmels@...0.net>
To: Jarkko Sakkinen <jarkko@...nel.org>
Cc: Ben Boeckel <me@...boeckel.net>, brauner@...nel.org, 
	ebiederm@...ssion.com, Luis Chamberlain <mcgrof@...nel.org>, 
	Kees Cook <keescook@...omium.org>, Joel Granados <j.granados@...sung.com>, 
	Serge Hallyn <serge@...lyn.com>, Paul Moore <paul@...l-moore.com>, 
	James Morris <jmorris@...ei.org>, David Howells <dhowells@...hat.com>, containers@...ts.linux.dev, 
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	linux-security-module@...r.kernel.org, keyrings@...r.kernel.org
Subject: Re: [PATCH 0/3] Introduce user namespace capabilities

On Thu, May 16, 2024 at 04:36:07PM GMT, Jarkko Sakkinen wrote:
> On Thu May 16, 2024 at 4:30 PM EEST, Ben Boeckel wrote:
> > I note a lack of any changes to `Documentation/` which seems quite
> > glaring for something with such a userspace visibility aspect to it.
> >
> > --Ben
> 
> Yeah, also in cover letter it would be nice to refresh what is
> a bounding set. I had to xref that (recalled what it is), and
> then got bored reading the rest :-)

Thanks for reminding me, I actually meant to do it, just forgot.
Having said that, `Documentation/security/credentials.rst` is not the
best documention when it comes to capabilities. I will definitely add
few more lines in there, but it's probably not what you're looking for.

capabilities(7) is where everything is explained, I should have
mentioned it. I could try to summarize the existing sets, but honestly I
will probably do a worse job than the man page.

I do plan to update the man page though if it comes to that.