Messages in this thread | | | Date | Fri, 22 Aug 1997 23:42:09 -0400 (EDT) | From | Todd Graham Lewis <> | Subject | Re: PACL Announce (was Re: Experimental yet...) |
| |
On Fri, 22 Aug 1997, linux kernel account wrote:
> I would hope that such fine grained security measures make their way in as > compile options and sysctls.. Because if they dont, once the kernel > reaches a stable state again I imagine this would be risking a split.. > > There are many features that many find unsutiable for the kernel in > general..
Indeed, PACL is unneeded for most personal machines; only network servers and firewalls really need it. If you look at the patch, you'll see that it's a config option, so people can chose to include it or not when they do a "make {menu,x}config"; if they don't chose it, then the old default is used and pacl is completely left out of the kernel.
I can't speak for the other features which you mention, but on the whole I agree that a lot of this stuff is not appropriate for end users. I actually did not intend pacl for most end users, but rather would like it handled at the distribution level. Since you need to insert your customized pacl before you start up your (not-running-as-root) network daemons, the distributions will need to handle this through their init procedures. If the way debian does other stuff is any indication (I can't speak for redhat), there will be an easy way for a package to add authority for its package-specific uid to use a particular port. All of this should work without the user's ever being aware that it's even there, unless, in the true Linux tradition, they simply get curious about the matter.
Has anyone actually tried the patch yet?
-- Todd Graham Lewis Manager of Web Engineering MindSpring Enterprises (800) 719-4664, x2804 Linux! tlewis@mindspring.net
| |