Re: Filesystem Capabilities in 2.6?

[Bernd Eckenfels]

In article <[e-mail]> you wrote:
> So I'd suggest _not_ attaching that capability to the sendmail binary
> itself, or to any inode number of that binary. A binary is a binary is a
> binary - it's just the data. Instead, I'd attach the information to the
> directory entry, either directly (ie the directory entry really has an
> extra field that lists the capabilities) or indirectly (ie the directory
> entry is really just an "extended symlink" that contains not just the path
> to the binary, but also the capabilities associated with it).

If you modify the object you need to find all attached labels to downgrade
it's capabilities. Therefore you need to find a way from the object to the
capabilities stored in various entries.

Greetings
Bernd