lkml.org 
[lkml]   [2007]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: group ownership of tun devices -- nonfunctional?
    On Mon, 20 Aug 2007, Rene Herman wrote:
    > On 08/19/2007 11:42 PM, Bodo Eggert wrote:

    > > The intended [my me] semantics is If the user is not
    > > * the allowed user
    > > or
    > > * member of the allowed group
    > > or
    > > * cabable of CAP_NET_ADMIN
    > > then error out. I'm asuming
    >
    > There is a short description of the desired semantics in the link that was
    > posted:
    >
    > http://lkml.org/lkml/2007/6/18/228
    >
    > ===
    > The user now is allowed to send packages if either his euid or his egid
    > matches the one specified via tunctl (via -u or -g respecitvely). If both
    > gid and uid are set via tunctl, both have to match.
    > ===
    >
    > Paraphrasing the original code above, it's saying:
    >
    > if ((owner_is_set && does_not_match) || (group_is_set && does_not_match))
    > bugger_off_unless(CAP_NET_ADMIN);
    >
    > or reverting the logic:
    >
    > if ((owner_is_unset || does_match) && (group_is_unset || does_match))
    > good_to_go();
    >
    > which probably matches the intention -- we're good to go only if the
    > credentials that are set also match.

    Maybe there are valid reasons to do it this way, but I think having it the
    way I described would be less confusing.

    --
    ¤ Bill of Spammer-Rights ¤
    1. We have the right to assassinate you.
    2. You have the right to be assassinated.
    3. You have the right to resist, but it is futile.
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-08-20 13:49    [W:0.028 / U:119.900 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site