lkml.org 
[lkml]   [2010]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] Fix dmesg_restrict build failure with CONFIG_EMBEDDED=y and CONFIG_PRINTK=n
On Mon, 15 Nov 2010, Eric Paris wrote:

> Not sure how that's possible. I mean, I guess it's possible if the
> fabled LSM reimplements the cap call, but I'm not sure how you can
> remove a restrictive only security check without 'weakening' the system
> in some way.

If generic security logic is mixed into a capability call, then not
implementing the cap call also loses the generic security logic.

e.g. dmesg_restrict should always be verified, regardless of whether
cap_security() is called or not.

If cap_syslog() should always be called, then it should not be possible
not not call it :-)


- James
--
James Morris
<jmorris@namei.org>


\
 
 \ /
  Last update: 2010-11-16 00:03    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site