All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: Vasiliy Kulikov <segoon@openwall.com>
Cc: linux-kernel@vger.kernel.org, Kees Cook <kees.cook@canonical.com>,
	Eugene Teo <eugeneteo@gmail.com>
Subject: Re: [RFC] add mount options to sysfs
Date: Thu, 19 May 2011 10:12:27 -0700	[thread overview]
Message-ID: <20110519171227.GB22019@suse.de> (raw)
In-Reply-To: <20110519062622.GA4418@albatros>

On Thu, May 19, 2011 at 10:26:23AM +0400, Vasiliy Kulikov wrote:
> On Wed, May 18, 2011 at 12:17 -0700, Greg KH wrote:
> > > 1) *IF* another sensitive file with weird permissions is found, mount
> > > option is IMO the best temporary workaround.
> > 
> > Maybe, but fixing the file would be the obvious solution.
> 
> I mean for a sysadmin, not for a developer.

And I mean for the developer.

We have checks in place now to prevent this type of thing from happening
again in the future.  If it does, and it might, we will fix it, it's
that simple.

> What do you mean by "breaking system"?  Root is able to chmod
> and chown sysfs files already, he may do "chmod -R" or similar.
> I suggest sane, race free way to globally restrict permissions *IF* root
> wants it.

If root wants it, they can do this today with a simple 1 line bash
command, so I don't see the issue.

> Here https://lkml.org/lkml/2011/2/25/300 you, not aware of usefull
> applications of world-writable debugfs file, agreeded to statically
> restrict permissions of all files.  I suggest more flexible and
> configurable in runtime solution.  It doesn't break anything - default
> behaviour doesn't differ from current one.  What has changed in your
> mind since 2/25?

That's debugfs, not sysfs, which we are talking about here, right?

thanks,

greg k-h

  reply	other threads:[~2011-05-19 17:15 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-05-18 16:31 [RFC] add mount options to sysfs Vasiliy Kulikov
2011-05-18 16:39 ` Greg KH
2011-05-18 17:05   ` Vasiliy Kulikov
2011-05-18 19:17     ` Greg KH
2011-05-19  6:26       ` Vasiliy Kulikov
2011-05-19 17:12         ` Greg KH [this message]
2011-05-20  9:59           ` Vasiliy Kulikov
2011-05-20 13:30             ` Greg KH
2011-05-20 13:34               ` Vasiliy Kulikov
2011-05-20 13:36                 ` Vasiliy Kulikov
2011-05-20 13:54                   ` Greg KH
2011-05-20 15:17                     ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110519171227.GB22019@suse.de \
    --to=gregkh@suse.de \
    --cc=eugeneteo@gmail.com \
    --cc=kees.cook@canonical.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=segoon@openwall.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.