Re: [PATCH v2 2/2] capabilities: Add a securebit to disable PR_CAP_AMBIENT_RAISE

2015-05-24 Thread Andrew G. Morgan
Thanks Acked-By: Andrew G. Morgan On Sat, May 23, 2015 at 12:45 PM, Serge E. Hallyn wrote: > On Thu, May 14, 2015 at 11:39:49PM -0700, Andy Lutomirski wrote: >> Per Andrew Morgan's request, add a securebit to allow admins to >> disable PR_CAP_AMBIENT_RAISE. This securebit will prevent process

Re: [PATCH v2 2/2] capabilities: Add a securebit to disable PR_CAP_AMBIENT_RAISE

2015-05-23 Thread Serge E. Hallyn
On Thu, May 14, 2015 at 11:39:49PM -0700, Andy Lutomirski wrote: > Per Andrew Morgan's request, add a securebit to allow admins to > disable PR_CAP_AMBIENT_RAISE. This securebit will prevent processes > from adding capabilities to their ambient set. > > For simplicity, this disables PR_CAP_AMBIEN

[PATCH v2 2/2] capabilities: Add a securebit to disable PR_CAP_AMBIENT_RAISE

2015-05-14 Thread Andy Lutomirski
Per Andrew Morgan's request, add a securebit to allow admins to disable PR_CAP_AMBIENT_RAISE. This securebit will prevent processes from adding capabilities to their ambient set. For simplicity, this disables PR_CAP_AMBIENT_RAISE entirely rather than just disabling setting previously cleared bits