Messages in this thread | | | Date | Thu, 5 Jan 2012 11:34:43 -0800 | Subject | Re: [PATCH v2012.1] fs: symlink restrictions on sticky directories | From | Kees Cook <> |
| |
On Thu, Jan 5, 2012 at 6:30 AM, Nick Bowler <nbowler@elliptictech.com> wrote: > On 2012-01-04 12:18 -0800, Kees Cook wrote: >> diff --git a/fs/Kconfig b/fs/Kconfig >> index 5f4c45d..26ede24 100644 >> --- a/fs/Kconfig >> +++ b/fs/Kconfig >> @@ -278,3 +278,19 @@ source "fs/nls/Kconfig" >> source "fs/dlm/Kconfig" >> >> endmenu >> + >> +config PROTECTED_STICKY_SYMLINKS >> + bool "Protect symlink following in sticky world-writable directories" >> + default y > [...] > > Why do we need a config option for this? What's wrong with just using > the sysctl?
This way the sysctl can configured directly without needing to have a distro add a new item to sysctl.conf.
> Why have you made this option "default y", when enabling it clearly > makes user-visible changes to kernel behaviour?
Ingo specifically asked me to make it "default y".
-Kees
-- Kees Cook ChromeOS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |