Lennart Poettering wrote:
But why not just block any other access? A tape drive wouldn't work
Because the device changes ownership
Traditional unix behavior is that open file descriptors stay open and
working even if access permissions change.
Yes, and you know what? Unix sucks.
Unix is a nice simple generalized system. The only thing that sucks
about it is that every person who has touched it trying to make it work
better in some specialized situation has invented their own bizarre and
unique configuration language with syntax as different as possible from
every other specialization. To the point that you can neither see the
simplicity nor deal with all the bolted-on afterthoughts. In any case,
making it only work like a single-user toy OS that makes bad assumptions
about devices isn't the way to fix it.
Just because something is the way Unix is doing it it doesn't mean
it's right. Also, Solaris has had frevoke() for some time, and we'll
hopefully get it on Linux soon, too. And when we have that, we can
kick any process from any fd at any time. Awesome! A Unix lover's
nightmare... Muahahaha!
There's nothing wrong with having the capabilities to do these things.
It is wrong to change defaults in a surprising way, its wrong to give
permissions according to where you are instead of who you are, and its
wrong to add default policy changes before documenting the way to manage
them locally in unsurprising ways.
--
Les Mikesell
lesmikesell@xxxxxxxxx
--
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-devel-list
