[gentoo-hardened] xattr/acl/cap

[Alex Efros]

Hi!

I'm not sure is this right place to ask…

What is current status for filesystem's xattr, acl and caps?

I'm usually keep all of this disabled in kernel, because I don't use them
and wanna avoid needless complexity. But today consolekit (which I don't
use, but which is installed anyway as someone's dependency) asked me to
enable CONFIG_TMPFS_POSIX_ACL. And I decide to check all this crap once again.

I may be wrong here, but after glance look at it I got this impression:

XATTR
    Needed only if you use ACL or CAPS (or wanna play with custom file
    attributes).
ACL
    Not sure about consolekit requirement above, but otherwise it looks
    useless (if you don't need to use complicated file permissions).
CAPS
    Looks promising, it's always good to remove suid bit, BUT:
    a)	looks like only app which uses it now on my workstation is
	wireshark, even /bin/ping is still installed suid
    b)	pam_cap.so doesn't used by default (not sure why) so you can't change
	user's default capabilities using /etc/security/capability.conf

So, until most/all suid apps in portage get CAPS support for me it looks
like it's better to switch off all these things.

-- 
			WBR, Alex.