All of lore.kernel.org
 help / color / mirror / Atom feed
From: Nick Bowler <nbowler@elliptictech.com>
To: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Gergely Nagy <algernon@balabit.hu>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	James Morris <jmorris@namei.org>
Subject: Re: CAP_SYSLOG, 2.6.38 and user space
Date: Thu, 3 Feb 2011 10:54:25 -0500	[thread overview]
Message-ID: <20110203155425.GA2270@elliptictech.com> (raw)
In-Reply-To: <20110203153252.GA24153@mail.hallyn.com>

On 2011-02-03 15:32 +0000, Serge E. Hallyn wrote:
> At 2.6.39 or 2.6.40, let's add a sysctl which defaults to 0.  When
> 0, refuse if cap_sys_admin, if 1, then allow.

This had better default to 1, since that's the "don't break working
systems" setting.  Users (more likely, distributions) can set it to 0
when they have new enough userspace.

> This will allow users to acknowledge (permanently, if they must, using
> /etc/sysctl.conf) that they've seen the syslog message about
> cap_sys_admin being deprecated for syslog.

Why should the user need to acknowledge anything in order for their
system to not be broken?  What are they supposed to do otherwise?

-- 
Nick Bowler, Elliptic Technologies (http://www.elliptictech.com/)

  parent reply	other threads:[~2011-02-03 15:54 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-02-03 11:39 CAP_SYSLOG, 2.6.38 and user space Gergely Nagy
2011-02-03 15:13 ` Alan Cox
2011-02-03 15:32 ` Serge E. Hallyn
2011-02-03 15:53   ` Gergely Nagy
2011-02-03 16:51     ` Serge E. Hallyn
2011-02-03 17:07       ` Gergely Nagy
2011-02-04  0:49       ` david
2011-02-04  8:03         ` Marc Koschewski
2011-02-04  8:40           ` Gergely Nagy
2011-02-04 11:08             ` Alan Cox
2011-02-04 16:03         ` Serge E. Hallyn
2011-02-03 15:54   ` Nick Bowler [this message]
2011-02-04 16:05   ` Serge E. Hallyn
2011-02-04 16:33     ` Gergely Nagy
2011-02-04 17:15       ` Serge E. Hallyn
2011-02-05  7:05         ` david
2011-02-06  1:18           ` Serge E. Hallyn
2011-02-09 21:23             ` Serge E. Hallyn
2011-02-09 21:28               ` Gergely Nagy
2011-02-09 21:34                 ` david
2011-02-09 21:40                   ` Gergely Nagy
2011-02-09 21:47                     ` david
2011-02-09 22:04                       ` Gergely Nagy
2011-02-09 22:27                         ` david
2011-02-09 22:37                           ` Gergely Nagy
2011-02-10 14:29                 ` Serge E. Hallyn
2011-02-09 19:50         ` Gergely Nagy

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110203155425.GA2270@elliptictech.com \
    --to=nbowler@elliptictech.com \
    --cc=algernon@balabit.hu \
    --cc=jmorris@namei.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=serge@hallyn.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.