lkml.org 
[lkml]   [2012]   [Jun]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v2] fs: introduce pipe-only dump mode suid_dumpable=3
From
On Fri, Jun 22, 2012 at 7:21 AM, Eric W. Biederman
<ebiederm@xmission.com> wrote:
> Kees Cook <keescook@chromium.org> writes:
>
>> This patch introduces suid_dumpable=3 to allow privilege-changed processes
>> to be dumped only to a pipe handler (and not directly to disk). The value
>> of suid_dumpable=2 is now deprecated, and attempting to set this sysctl
>> value returns -EINVAL.
>
> Your patch descriptoin is wrong.  Deprecate means something is encouraged
> not to be used not that the functionality is removed.  I think what
> you are trying to say is that the value suid_dumpable=2 is now historic.
>
> Your implementation is absolutely gross.  Reading the value from
> twice from user space??    Is an if statement that hard to code?

I will rework this and resend.

-Kees

--
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2012-06-22 18:21    [W:0.095 / U:0.708 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site