lkml.org 
[lkml]   [2015]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [GIT PULL] kdbus for 4.1-rc1
    On Apr 23, 2015 11:56 AM, "Greg Kroah-Hartman"
    <gregkh@linuxfoundation.org> wrote:
    >
    > On Thu, Apr 23, 2015 at 11:04:36AM -0700, Linus Torvalds wrote:
    > > On Thu, Apr 23, 2015 at 10:57 AM, Linus Torvalds
    > > <torvalds@linux-foundation.org> wrote:
    > > >
    > > > If somebody is printing something, it shouldn't matter if it's "lpr"
    > > > or "firefox http://horses.and.trannyporn.my.little.pony.com/" that
    > > > does the printing.
    > >
    > > And btw, it's not just "this is information that shouldn't be logged".
    > >
    > > It's literally "information that should not *ever* be used". I can
    > > easily see some phone manufacturer deciding to do "value add" by
    > > adding a special case where a special vendor system manager program
    > > gets a back door to some service, because it needs to access the
    > > camera for user identification at login time, so there's some magic
    > >
    > > if (!strcmp(client->pid_comm, "vendor-login-pr"))
    > > return ACCESS_OK;
    > >
    > > because "it was the simplest way to do this", and the programmer knew
    > > it was a hack, but he needed to get it working because he had a
    > > deadline yesterday.
    > >
    > > And then somebody figures this out, and makes an app that takes
    > > pictures on your phone surreptitiously.
    > >
    > > No, we can't protect against vendors doing stupid things, but we very
    > > much also shouldn't make the kernel have interfaces that basically
    > > encourage people to do stupid things because they make irrelevant and
    > > wrongheaded data available.
    >
    > Doing access control based on comm and cmdline is horrid, I totally
    > agree. But right now, any process in the system can read any other
    > process's comm and cmdline value out of /proc today. So removing it
    > from the metadata is fine for kdbus, I can live with that, but it really
    > isn't "preventing" anything that's not already visible to everyone, so
    > if someone wanting to be "bad" could always still log it or do anything
    > else they wanted with it.

    I feel like a broken record. This isn't true in general. Selinux can
    and, I believe, often does prevent this.

    --Andy


    \
     
     \ /
      Last update: 2015-04-23 22:01    [W:4.113 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site