Quoting Andy Lutomirski (l...@amacapital.net): > It's especially bad because granting CAP_DAC_READ_SEARCH to user "foo" > doesn't mean anything. Is he authorized to back things up to > encrypted storage?
We're talking about privileges at the kernel level here, and there is no way this could be expressed at that level. Higher level tools could/should certainly be exposing things at this level. BUT You *are* doing a good job of making me feel that we should have per-user fI xattrs or acls. Sudo is popular because people like to say "user joe can run foo with privilege". Most people will never want to be bothered to say "user joe can run foo with CAP_XYZ" (versus "as root"), but I do think we could get programs/packages to do that. Note that another difficulty here likes in the age-old, as yet unanswered imo, question of "how do I easily figure out what caps I need to run my program." A few years ago I pointed to this (perhaps in mostly private emails, don't recall) as something to be solved, but the solution escapes me. -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
