Re: Filesystem Capabilities in 2.6?

[Alan Cox]

On Sun, 2002-11-03 at 16:30, Ragnar Kjørstad wrote:
> On Sun, Nov 03, 2002 at 04:20:08PM +0100, Bernd Eckenfels wrote:
> > In article <[e-mail]> you wrote:
> > > Namespaces is a way to inherit revocation of rights on a large scale (or
> > > a small one true). #! is a way to handle program specific revocation of
> > > rights which _is_ filesystem persistent.
> > 
> > #! would be a nice option to increase capabilities on invocation. But the
> > final target must be linked to the invocation by an entity/revision binding.
> > Since we do not have modification versions i could think about checksums:
> 
> Unfortenately it will be much harder to find all executables with
> increased capabilities on your system. 

You need a way to mark applications which may be run with increased
capabilities and which ones are permitted yes, and by object not by name