lkml.org 
[lkml]   [2011]   [Feb]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: CAP_SYSLOG, 2.6.38 and user space
On Fri, 4 Feb 2011, Serge E. Hallyn wrote:

> Quoting Gergely Nagy (algernon@balabit.hu):
>> On Fri, 2011-02-04 at 16:05 +0000, Serge E. Hallyn wrote:
>>> Quoting Serge E. Hallyn (serge@hallyn.com):
>>>>> From 2d7408541dd3a6e19a4265b028233789be6a40f4 Mon Sep 17 00:00:00 2001
>>>> From: Serge Hallyn <serge@peq.(none)>
>>>>
>>>> At 2.6.39 or 2.6.40, let's add a sysctl which defaults to 0. When
>>>> 0, refuse if cap_sys_admin, if 1, then allow. This will allow
>>>> users to acknowledge (permanently, if they must, using /etc/sysctl.conf)
>>>> that they've seen the syslog message about cap_sys_admin being
>>>> deprecated for syslog.
>>>>
>>>> Signed-off-by: Serge Hallyn <serge@hallyn.com>
> - goto warn; /* switch to return -EPERM after 2.6.39 */
> + !capable(CAP_SYSLOG)) {
> + /* remove after 2.6.39 */
> + if (capable(CAP_SYS_ADMIN))
> + WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
> + "but no CAP_SYSLOG (deprecated).\n");
> + else
> + return -EPERM;
> + }
> }

why does this need to be removed after 2.6.39?

whenever you go to remove it you will break userspace, what's the benifit
of breaking userspace?

I can understand that it's better to have a syslog daemon with CAP_SYSLOG
instead of CAP_SYS_ADMIN, but does "it would be better to have userspace
changed" really translate into "it's so important to have userspace
changed that we need to break any userspace that hasn't changed"?

I really don't think so.

David Lang


\
 
 \ /
  Last update: 2011-02-05 08:09    [W:0.724 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site