RE: Potential future capabilities hole!!

[Jeremy Fitzhardinge]

On 08-Jun-99 Chris Evans wrote:
> I just noticed that the kernel executes "modprobe" with _all_ capabilities
> raised.
> 
> This might cause headache in the future, when we can run without a root
> user (and/or ban certain capabilities from ANYONE on the system), because
> 
> 1) The user owning the "modprobe" binary will be able to take over the
> system

Yep, because modprobe puts new code in the kernel, where it can do anything
it likes.  If you don't trust modprobe, there's not a lot you can do.

        J