On Fri, 24 Apr 2015, Serge Hallyn wrote: > > I object because CAP_SETPCAP is very powerful whereas > > CAP_NET_BIND_SERVICE, for example, isn't. I'm fine with having a > > switch to turn off ambient caps, but requiring the "on" state to give > > Would only really be needed for the initial 'enable ambient caps for this > process tree', though. Once that was set, add/remove'ing caps from the > ambient set wouldn't need to be required.
Exactly. Its much simpler than alternate approaches. And its convoluted enough. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
