lkml.org 
[lkml]   [2000]   [Jul]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: disk-destroyer.c
On Sat, Jul 22, 2000 at 11:40:37PM +0100, James Sutherland wrote:

> > It's IMPOSSIBLE as long as "root is god". And if root was retired from gods
> > via /proc/sys/kernel/cap-bound it's impossible at all and you do not need
> > this patch for that.
>
> So long as not having CAP_DESTROY_HARDWARE prevents this, and
> CAP_DESTROY_HARDWARE isn't available to anything by default, that's OK.

It's no good to have any capability other than CAP_SYS_RAWIO protect us
from direct talking to the drives via IOCTLs, because only after
switching this one off we can't do so by other means as well.

CAP_DESTROY_HARDWARE would be superfluous, you'd need to disable that,
*and* CAP_SYS_RAWIO as well to protect yourself from the damage.

Also, CAP_SYS_RAWIO is the exact capability meant for this type of
stuff.

--
Vojtech Pavlik
SuSE Labs

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.108 / U:0.796 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site