> Just the same, I believe that the security folks consider it good > practice to bracket the use of privileges so that they're not just > lingering in the effective set. Sure, it's probably just "security by > obscurity," but the issue that I'm trying to confront is that giving > ipadm file_dac_write gives it a lot more power than it otherwise > should have, so caution is a good thing.
Yes, if the intent is just to protect trusted code from shooting itself in the foot, then no objections here. -- meem
