Messages in this thread Patch in this message | | | Date | Thu, 1 Apr 2004 10:12:56 -0800 | From | William Lee Irwin III <> | Subject | Re: disable-cap-mlock |
| |
On Thu, Apr 01, 2004 at 09:44:05AM -0800, William Lee Irwin III wrote: >> I'm aware it does some very unintelligent things to the security model, >> e.g. anyone with fs-level access to these things can basically escalate >> their capabilities to "everything". Maybe some kind of big fat warning >> is in order.
And maybe proper directory permissions, too.
Index: mm4-2.6.5-rc3/security/sysctl_capable.c =================================================================== --- mm4-2.6.5-rc3.orig/security/sysctl_capable.c 2004-04-01 09:41:41.000000000 -0800 +++ mm4-2.6.5-rc3/security/sysctl_capable.c 2004-04-01 10:11:53.000000000 -0800 @@ -111,7 +111,7 @@ { .ctl_name = CTL_KERN, .procname = "capability", - .mode = 0644, + .mode = 0555, .child = capability_sysctl_table, }, { - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |