|
|
| [Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] |
On Fri, Apr 6, 2012 at 12:49, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote: > On Thu, 29 Mar 2012 15:01:46 -0500 > Will Drewry <wad@xxxxxxxxxxxx> wrote: >> From: Andy Lutomirski <luto@xxxxxxxxxxxxxx> >> With this set, a lot of dangerous operations (chroot, unshare, etc) >> become a lot less dangerous because there is no possibility of >> subverting privileged binaries. I don't want to derail things. So, tell me to go away, if I can't have what I want. Having said that, it would be great if NO_NEW_PRIVS also gave access to the restricted clone() flags. Such as CLONE_NEWIPC, CLONE_NEWNET and CLONE_NEWPID. Markus -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
[Fedora Maintainers] [Fedora Desktop] [Fedora SELinux] [Yosemite News] [Yosemite Photos] [KDE Users] [Fedora Tools]
