On Wed, 2013-02-13 at 09:51 -0800, Casey Schaufler wrote: > On 2/13/2013 9:26 AM, Matthew Garrett wrote: > > Admit that CAP_SYS_RAWIO is fucked up beyond rescue. Add a new > > capability with well-defined semantics. > > You can't add a new capability where there is an existing capability > that can be remotely argued to be appropriate.
CAP_SYS_RAWIO can't be argued to be appropriate. It covers a range of functionality that doesn't permit the running kernel to be modified and which is required to provide a functional Linux system. Using it would require redefining its existing usage, which would break existing userspace. -- Matthew Garrett | mj...@srcf.ucam.org
