Messages in this thread | | | Date | Tue, 16 Nov 2010 09:58:37 +1100 (EST) | From | James Morris <> | Subject | Re: [PATCH] Fix dmesg_restrict build failure with CONFIG_EMBEDDED=y and CONFIG_PRINTK=n |
| |
On Mon, 15 Nov 2010, Eric Paris wrote:
> Not sure how that's possible. I mean, I guess it's possible if the > fabled LSM reimplements the cap call, but I'm not sure how you can > remove a restrictive only security check without 'weakening' the system > in some way.
If generic security logic is mixed into a capability call, then not implementing the cap call also loses the generic security logic.
e.g. dmesg_restrict should always be verified, regardless of whether cap_security() is called or not.
If cap_syslog() should always be called, then it should not be possible not not call it :-)
- James -- James Morris <jmorris@namei.org>
| |