[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Re: [RFC] locking down rsyslog.service

Michael Biebl wrote:
> - CAP_SYS_ADMIN: exceed /proc/sys/fs/file-max, the system-wide limit
> on the number of open files, in system calls that open files (e.g.
> accept execve), use of setns(),...

I realize that you can't lock down things upstream still requires, but
CAP_SYS_ADMIN is root-equivalent and probably always will be. This would
be top on the list of capabilities to try to get upstream to provide a
way to do without.

Reply to: