Hi!
I'm not sure is this right place to ask…
What is current status for filesystem's xattr, acl and caps?
I'm usually keep all of this disabled in kernel, because I don't use them
and wanna avoid needless complexity. But today consolekit (which I don't
use, but which is installed anyway as someone's dependency) asked me to
enable CONFIG_TMPFS_POSIX_ACL. And I decide to check all this crap once again.
I may be wrong here, but after glance look at it I got this impression:
XATTR
Needed only if you use ACL or CAPS (or wanna play with custom file
attributes).
ACL
Not sure about consolekit requirement above, but otherwise it looks
useless (if you don't need to use complicated file permissions).
CAPS
Looks promising, it's always good to remove suid bit, BUT:
a) looks like only app which uses it now on my workstation is
wireshark, even /bin/ping is still installed suid
b) pam_cap.so doesn't used by default (not sure why) so you can't change
user's default capabilities using /etc/security/capability.conf
So, until most/all suid apps in portage get CAPS support for me it looks
like it's better to switch off all these things.
--
WBR, Alex.
