Messages in this thread | | | Date | Tue, 21 Jul 2009 17:30:19 +0100 | From | Alan Cox <> | Subject | Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero operations |
| |
On Tue, 21 Jul 2009 12:23:14 -0400 Eric Paris <eparis@redhat.com> wrote:
> On Tue, 2009-07-21 at 17:09 +0100, Alan Cox wrote: > > > It's a really ugly problem that almost begs for better hardware > > facilities (such as the multiple independent address spaces in some > > processors) > > If only we knew someone who worked at intel..... *smile* > > Are you on board with the change I propose as long as I make the address > space controlled by SELinux tunable instead of fixed at one page? Thus > allowing one to maintain the status quo? Yeah, still sucks for > non-selinux systems and wine, but at least there can be hardening > against a non-root local authenticated user on a default fedora > install...
I don't like it much, but I have exactly zero better ideas. It's also your area of expertise not mine, so I'm not going to object further.
Alan
| |