lkml.org 
[lkml]   [2005]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [06/07] [PATCH] SCSI tape security: require CAP_ADMIN for SG_IO etc.
From
Date
On Thu, 2005-04-28 at 08:43 +0300, Kai Makisara wrote:
> On Wed, 27 Apr 2005, Alan Cox wrote:
>
> > On Mer, 2005-04-27 at 18:16, Greg KH wrote:
> > > -stable review patch. If anyone has any objections, please let us know.
> >
> > This patch is just wrong on so many different levels its hard to know
> > where to begin.
> >
> > 1. The auth for arbitary commands is CAP_SYS_RAWIO
>
> Valid complaint.
>
> > 2. "The SCSI command permissions were discussed widely on the linux
> > lists but this did not result in any useful refinement of the
> > permissions." - this is false. The process was refined, a table setup
> > was added and debugged.
>
> Any user having write access to the device is still allowed to send MODE
> SELECT (and some other commands useful for CD/DVD writers but being
> potentially dangerous to other).

If you give your user *WRITE ACCESS* to the tape you expect him to be
able to do a lot of writing, right? The restrictions for *READ* are
obviously more clear...

> OK. If the Linux solution to these kind of security problems in the not so
> central areas of kernel is to wait and see if the problem disappears
> without any action, I have to accept that. But I have tried...

the security problem is giving someone write access to a device and then
somehow expect that to mean "selective write" ?




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-04-29 11:54    [W:0.257 / U:0.288 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site