lkml.org 
[lkml]   [2009]   [Jul]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero operations
On Tue, 21 Jul 2009 12:23:14 -0400
Eric Paris <eparis@redhat.com> wrote:

> On Tue, 2009-07-21 at 17:09 +0100, Alan Cox wrote:
>
> > It's a really ugly problem that almost begs for better hardware
> > facilities (such as the multiple independent address spaces in some
> > processors)
>
> If only we knew someone who worked at intel..... *smile*
>
> Are you on board with the change I propose as long as I make the address
> space controlled by SELinux tunable instead of fixed at one page? Thus
> allowing one to maintain the status quo? Yeah, still sucks for
> non-selinux systems and wine, but at least there can be hardening
> against a non-root local authenticated user on a default fedora
> install...

I don't like it much, but I have exactly zero better ideas. It's also
your area of expertise not mine, so I'm not going to object further.

Alan


\
 
 \ /
  Last update: 2009-07-21 18:33    [W:0.038 / U:0.808 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site