Messages in this thread | | | Date | Wed, 21 Apr 2004 11:54:11 -0700 | From | Chris Wright <> | Subject | Re: compute_creds fixup in -mm |
| |
* Stephen Smalley (sds@epoch.ncsc.mil) wrote: > On Wed, 2004-04-21 at 14:28, Chris Wright wrote: > > * Stephen Smalley (sds@epoch.ncsc.mil) wrote: > > > I didn't see Chris' patch. I assume that the worst case is unexpected > > > program failure due to lack of capability, right? The SELinux security > > > > The opposite. You'd get a program with non-root euid, but full > > capability set, and AT_SECURE set false. My patch is below. > > Sorry, I wasn't clear. I meant the worst case due to the share/ptrace > state check being duplicated in SELinux and in commoncap, as opposed to > being performed once as in Andy's patch.
Ah, indeed.
thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |