Messages in this thread | ![/](/images/icornerl.gif) | | Date | Mon, 29 Nov 2010 11:38:22 -0800 | From | "H. Peter Anvin" <> | Subject | Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking |
| |
On 11/29/2010 11:21 AM, Eric Paris wrote: >> >> Delegating CAP_SYS_ADMIN, of course, otherwise known as "everything", is >> worse than anything... > > Serge just proposed a new CAP_SYSLOG > > http://lwn.net/Articles/378472/ > > Which could probably still be renamed and used to cover this access as well.... >
Quite frankly, the Linux capability system is largely a mess, with big bundled capacities that don't make much sense and are hideously inconvenient with the capability system used in user space (groups). For things like this that genuinely has a file node, *let's use it* and allow permissions to be controlled by the file node!
-hpa
| ![\](/images/icornerr.gif) |