On Sun, Jul 16, 2006 at 09:24:36PM +0200, Blaisorblade wrote: > On Sunday 16 July 2006 14:05, Frank v Waveren wrote: > > On Sun, Jul 16, 2006 at 12:31:51PM +0200, Blaisorblade wrote: > > > On Saturday 15 July 2006 17:23, Frank v Waveren wrote: > > > > I was trying to limit some unecessary capabilities in a UML instance > > > > with /proc/sys/kernel/cap-bound, but it turned out not to take. > > > > > > To remove capabilities from the whole system (i.e. all processes) the > > > recommended way wasn't to use lcap (or a similar program bundled with > > > libcap)? > > > > Yup, lcap is just an interface to /proc/sys/kernel/cap-bound. > > I remember maybe some differences UML specific capabilities code in arch/um > (it used to clear some capabilities, i.e. /dev/mem or /dev/kmem access). > Check for that...
There used to be (in the tt mode jail support), but it's all gone now (leaving some undefined prototypes in the headers about jail mode and such by the way). Oh well, I'll have to go poke in a live non-UML kernel and see what's different, I'll keep the list posted. -- Frank v Waveren Key fingerprint: BDD7 D61E [EMAIL PROTECTED] 5D39 CF05 4BFC F57A Public key: hkp://wwwkeys.pgp.net/468D62C8 FA00 7D51 468D 62C8
signature.asc
Description: Digital signature
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ User-mode-linux-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
