lkml.org 
[lkml]   [2004]   [Feb]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC][PATCH} 2.6 and grsecurity
From Valdis.Kletnieks@vt ...
DateTue, 17 Feb 2004 09:53:38 -0500
On Tue, 17 Feb 2004 15:23:33 +0100, Martin Waitz said:

> you could #define security_enable_* to 0 when CONFIG_SECURITY_*
> is disabled. thay way you don't need the ugly #ifdef in the .c file

Good point - as I mentioned to another person, I was trying to minimize the
code changes if the feature wasn't selected.

> on the other hand, why do one need a syscall anyway.
> only to justify the existence of some ugly lockdown mode?

For testing and backout - if for some odd reason you discover that it breaks
code, an 'echo 0 >' is a lot less disruptive than a full reboot.

The other reason is for distribution - if you're building a kernel for a bunch
of users, some of who disagree with it, you can ship it as the code is, and
then those who don't like one or two features can 'echo 0 >' onto those sysctls
and then 'echo 0 >' onto the one to force them read-only. Again, less hassle
than rebuilding a kernel with one CONFIG_SECURITY_WHATEVER turned off (and then
remember to re-rebuild on those machines each time a new kernel gets rolled out
- you can just leave the sysctl's in your /etc/rc.* and be happy).

[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 14:01    [from the cache]
©2003-2010