[lkml]   [2010]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] Fix dmesg_restrict build failure with CONFIG_EMBEDDED=y and CONFIG_PRINTK=n
On Mon, 15 Nov 2010, Eric Paris wrote:

> Not sure how that's possible. I mean, I guess it's possible if the
> fabled LSM reimplements the cap call, but I'm not sure how you can
> remove a restrictive only security check without 'weakening' the system
> in some way.

If generic security logic is mixed into a capability call, then not
implementing the cap call also loses the generic security logic.

e.g. dmesg_restrict should always be verified, regardless of whether
cap_security() is called or not.

If cap_syslog() should always be called, then it should not be possible
not not call it :-)

- James
James Morris

 \ /
  Last update: 2010-11-16 00:03    [W:0.065 / U:0.460 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site