Re: sys_admin cap breakup

On Mon, 2004-04-12 at 08:58, Colin Walters wrote:
> On Sun, 2004-04-11 at 22:34, Joshua Brindle wrote:
>
> > So this is a question for the guys that are doing kernel work and
> > possibly interacting with linus and friends. How plausible would it be
> > to suggest breaking up caps that give lots of access in the next major
> > version, 2.7 or 2.8? do you think they'd go for it?
>
> Maybe a better solution is to simply stop using capabilities entirely,
> and make the necessary changes to the policy.

Yes, although this still requires adding a LSM hook to abstract the new security check and defining new classes and permissions as appropriate for SELinux. SELinux should eventually replace capabilities entirely and provide complete privilege management using RBAC/TE.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.