Messages in this thread | | | Date | Wed, 8 Dec 2010 16:42:35 +0000 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH] syslog: check cap_syslog when dmesg_restrict |
| |
Quoting Eric Paris (eparis@redhat.com): > On Wed, 2010-12-08 at 15:19 +0000, Serge E. Hallyn wrote: > Doesn't this return -EPERM right now?
Yes.
> I think the code might be > incorrect today as well...... > > I thought the flow was supposed to be > > if (capable(CAP_SYSLOG)) > all good > else if (capable(CAP_SYS_ADMIN)) > WARN, but still good for now
I prefer warn and deny. Otherwise it's too easy to ignore warnings. So I prefer the msg to be there to explain why it failed - not that I expect it to fail for anyone today.
> else > EPERM > > But it looks to me like the flow is > > if (capable(CAP_SYSLOG)) > all good > else if (capable(CAP_SYS_ADMIN)) > WARN, EPERM > else > EPERM > > > }
Yup.
-serge
| |