iodine
iodine copied to clipboard
yarrick
Linux capabilities
This feels very Linux-specific. What do you think about adding a new argument flag that skips the check, and then it is up to the user to make it work anyway
If we do it like this I think it makes sense to exit only after all checks are done, so that the user does not keep getting new errors after fixing the first one.
capng_get_caps_process failure should fall back to the old uid 0 check also I think
This feels very Linux-specific. What do you think about adding a new argument flag that skips the check, and then it is up to the user to make it work anyway
That can be an additional argument that does not intersect with proposed changes. Proposed changes allow more granular capabilities checking and reporting.
If we do it like this I think it makes sense to exit only after all checks are done, so that the user does not keep getting new errors after fixing the first one.
Thanks for the suggestion, forced-pushed with this change, please check.
capng_get_caps_processfailure should fall back to the old uid 0 check also I think
Nope. Having UID 0 doesn't guarantee having all the required capabilities. On Linux root (UID 0) can also be restricted.