On Wed, Jul 15, 2015 at 4:13 AM, James Morris <jmorris@xxxxxxxxx> wrote: > On Tue, 14 Jul 2015, Andy Lutomirski wrote: > >> ===== The proposed change ===== >> >> This patch adds a fifth capability mask called the ambient mask >> (pA). pA does what most people expect pI to do. >> > > This looks good, and I think it will lead to better overall security > because people will find capabilities easier to use for real-world > scenarios. > > Has it had enough security review? This is a significant new behavior > being added to a widely enabled security module. > I've reviewed it, as have Kees and Serge. Of course, I wrote it, so my review should be taken with many grains of salt. I'll review it again between now and 4.3. All of my security thought cycles are currently taken up by a really nasty bug that dwarfs and problems this code could possibly introduce :) --Andy > > > - James > -- > James Morris > <jmorris@xxxxxxxxx> > -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
