Messages in this thread |  | | | From | Linus Torvalds <> | | Date | Wed, 18 Jan 2012 11:39:41 -0800 | | Subject | Re: Compat 32-bit syscall entry from 64-bit task!? |
| |
On Wed, Jan 18, 2012 at 11:36 AM, Andi Kleen <andi@firstfloor.org> wrote: > > The real fix is really to use a LSM for custom jails. Trying to make > ptrace secure is trying to make a sieve wather tight by plugging the individual > holes one by one. It's simply not suitable for this.
Umm. But the exact same is true of "LSM for custom jail". It's a f*&^ing disaster, and it's a whole lot more complicated than ptrace.
Plus it can't even do what ptrace does, so what's the point? There's a lot of system calls that don't have any kind of lsm hooks, and shouldn't. Exactly because THAT is a "plugging individual holes one by one" approach.
Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |