[cobalt-security] lcap, /dev/mem and CAP_SYS_RAWIO

[Stuart Robinson <stuart@xxxxxxxxxxxxxxxxx>]

According to the LCAP homepage <http://home.netcom.com/~spoon/lcap/> setting CAP_SYS_MODULE without setting CAP_SYS_RAWIO is of limited benefit as root can still write to /dev/mem. Setting CAP_SYS_RAWIO breaks X but does it break any software on a RAQ? I was particularly thinking of tcpdump and its kindred.

Thanks,
Stu.