Messages in this thread | | | Date | Fri, 4 Feb 2011 11:08:42 +0000 | From | Alan Cox <> | Subject | Re: CAP_SYSLOG, 2.6.38 and user space |
| |
> Having both CAP_SYS_ADMIN and CAP_SYSLOG at the same time, for the sole > purpose of reading kernel log messages would kind of defeat the purpose > of CAP_SYSLOG. Therefore, a solution that allows both at the same time > doesn't look all that good to me.
If you do it right you don't need both, you need either, so old code will use CAP_SYS_ADMIN and work, newer code will use CAP_SYSLOG and work but hold less rights. In a couple of years you can then drop the CAP_SYS_ADMIN ability to read log files, providing it is in the list of API deprecations soon...
> However, having it toggle-able does, and solves all my worries at least: > defaulting to CAP_SYS_ADMIN maintains backwards compatibility, upgraded > systems can switch to CAP_SYSLOG if and when the system is ready for > that. All's well!
Still a mess, we don't break ABIs at random so this patch needs reverting or fixing ASAP, otherwise Linus will just revert it anyway..
Alan
| |