Messages in this thread | | | Date | Thu, 1 Apr 2004 19:49:10 +0200 | From | Andrea Arcangeli <> | Subject | Re: disable-cap-mlock |
| |
On Thu, Apr 01, 2004 at 09:44:05AM -0800, William Lee Irwin III wrote: > I'm aware it does some very unintelligent things to the security model, > e.g. anyone with fs-level access to these things can basically escalate > their capabilities to "everything". Maybe some kind of big fat warning > is in order.
a similar issue happens with the disable-cap-mlock, but it gives only mlock to the guy with fs-level fsuid = 0 access, so the security implications are greatly lower, no way to do anything really bad with just access to mlock (DoS is the very worst scenario, and it's not very different from swapoff -a anyways, or again not very different from filling the swap enterely as far as security is concerned). - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |