Messages in this thread |  | | Subject | Re: [PATCH] proc: restrict access to /proc/interrupts | From | Valdis.Kletnieks@vt ... | Date | Mon, 07 Nov 2011 15:10:59 -0500 |
| |
On Mon, 07 Nov 2011 11:18:32 PST, "H. Peter Anvin" said:
> I would like to propose that we add a mount option to procfs, and > possibly sysfs, called, say, admingrp. These kinds of files then get > restricted to the admingrp (defaulting to gid 0 if no admingrp is > provided). Historically on Unix there has been a group of people > (usually "adm", but sometimes "log") who are allowed to read (but not > write) the log files, which also contains potentially sensitive information.
Probably should be a two part - mount with 'gid=NNN', and then a perm=027 or whatever, to be treated similar to a umask. So 027 would allow root to do anything, would disable write for the gid= group, and turn it off completely for others. Less paranoid sites could mount it with perm=002.
Does that cover most of the use cases?
> The current Linux trend seems to be do instead force those users to > become root constantly, which is *not* helping the situation.
Amen, brother. ;) [unhandled content-type:application/pgp-signature] |  |