lkml.org 
[lkml]   [2010]   [Dec]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] syslog: check cap_syslog when dmesg_restrict
Quoting Eric Paris (eparis@redhat.com):
> On Wed, 2010-12-08 at 15:19 +0000, Serge E. Hallyn wrote:
> Doesn't this return -EPERM right now?

Yes.

> I think the code might be
> incorrect today as well......
>
> I thought the flow was supposed to be
>
> if (capable(CAP_SYSLOG))
> all good
> else if (capable(CAP_SYS_ADMIN))
> WARN, but still good for now

I prefer warn and deny. Otherwise it's too easy to ignore warnings. So
I prefer the msg to be there to explain why it failed - not that I expect
it to fail for anyone today.

> else
> EPERM
>
> But it looks to me like the flow is
>
> if (capable(CAP_SYSLOG))
> all good
> else if (capable(CAP_SYS_ADMIN))
> WARN, EPERM
> else
> EPERM
>
> > }

Yup.

-serge


\
 
 \ /
  Last update: 2010-12-08 17:45    [W:0.068 / U:0.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site