Kees Cook wrote:
> AFD was a single specific program doing a very specific task and hardly
> represents an "average workload". I remain extremely disappointed that the
> default-on state was reverted. Ubuntu has had this feature enabled for
> YEARS now, and it stopped quite a few exploits cold.
Who knows what other applications this extremely surprising and incompatible
change breaks? (IMHO, even private /tmp is a better solution. It's also an
incompatible change, but at least it has semantics a normal user can
understand, whereas your solution layers really complicated hidden rules on
top of something as basic as file permissions.)
I'm with Linus when he says "Breaking applications is unacceptable. End of
story. It's broken them. Get over it." We aren't ready to enable private
/tmp for the same reason, so why is this hack any more acceptable?
IMHO the initscripts change should be reverted and we should stick to
Linus's defaults. He said "no" for a reason.
Kevin Kofler
--
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/devel
