Re: Filesystem Capabilities in 2.6?

[Rogier Wolff]

On Sat, Nov 02, 2002 at 06:05:09PM -0800, Linus Torvalds wrote:
> 
> On Sat, 2 Nov 2002, David D. Hagood wrote:
> > Linus Torvalds wrote:
> > >
> > > And pathnames are a _hell_ of a lot better and straightforward interface
> > > than inode numbers are. It's confusing when you change the permission on
> > > one path to notice that another path magically changed too.
> > 
> > Would this not allow a user to add permissions to a file, by creating a 
> > new directory entry and linking it to an existing inode?
> > 
> > Would that not be a greater security hole?
> 
> No. The file itself has _no_ capabilities at all. If you just link to it,
> you can give it whatever capabilities _you_ have as a user (well, normal
> users don't really have any capabilities to give, but you get the idea).

Capabilties done right, means that normal users DO have capabilities. 
Normal users have the capability to call normal syscalls like "read", 
"write" and "execve".

And once you have these included in the capabilities (which normal users
and programs normally have by default), you can take them away if you
want. For example, a non-scripting webserver may not require any use of
the "execve" system call.

Oh, it's easy to get a "vector" of over 100 capabilities this way. This
might be inefficient. Thus, it would be required that we get two levels:
first level as you're thinking of it: split capabilities for what 
"root" now has, and the other also splitting the "normal user"'s 
capabilities (and splitting the root-kinds even further).

		Roger.

-- 
** [e-mail] ** http://www.BitWizard.nl/ ** [phone] **
*-- BitWizard writes Linux device drivers for any device you may have! --*
* The Worlds Ecosystem is a stable system. Stable systems may experience *
* excursions from the stable situation. We are currently in such an      * 
* excursion: The stable situation does not include humans. ***************