| |||||||||||||
CAP_SYS_ADMIN: the new rootCAP_SYS_ADMIN: the new rootPosted Mar 15, 2012 2:54 UTC (Thu) by lutchann (subscriber, #8872)In reply to: CAP_SYS_ADMIN: the new root by tialaramex Parent article: CAP_SYS_ADMIN: the new root
> Mistakenly adding some root-equivalent privilege to a capability because it "looked appropriate" superficially would be almost as bad as accidentally removing the capability checks from something vital.
Yes, exactly. I don't want to have to grep every new kernel for CAP_.* to see if my containers are suddenly going to gain privileges that I didn't want them to have. I'm much happier with everything new going under CAP_SYS_ADMIN, which is already widely known to be a root equivalent.
(Log in to post comments)
|
|||||||||||||