lkml.org 
[lkml]   [2010]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] Fix dmesg_restrict build failure with CONFIG_EMBEDDED=y and CONFIG_PRINTK=n
    On Mon, 15 Nov 2010, Eric Paris wrote:

    > Not sure how that's possible. I mean, I guess it's possible if the
    > fabled LSM reimplements the cap call, but I'm not sure how you can
    > remove a restrictive only security check without 'weakening' the system
    > in some way.

    If generic security logic is mixed into a capability call, then not
    implementing the cap call also loses the generic security logic.

    e.g. dmesg_restrict should always be verified, regardless of whether
    cap_security() is called or not.

    If cap_syslog() should always be called, then it should not be possible
    not not call it :-)


    - James
    --
    James Morris
    <jmorris@namei.org>


    \
     
     \ /
      Last update: 2010-11-16 00:03    [W:0.315 / U:3.504 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site