On Thu, Jan 5, 2012 at 6:30 AM, Nick Bowler <nbowler@xxxxxxxxxxxxxxxx> wrote: > On 2012-01-04 12:18 -0800, Kees Cook wrote: >> diff --git a/fs/Kconfig b/fs/Kconfig >> index 5f4c45d..26ede24 100644 >> --- a/fs/Kconfig >> +++ b/fs/Kconfig >> @@ -278,3 +278,19 @@ source "fs/nls/Kconfig" >> source "fs/dlm/Kconfig" >> >> endmenu >> + >> +config PROTECTED_STICKY_SYMLINKS >> + bool "Protect symlink following in sticky world-writable directories" >> + default y > [...] > > Why do we need a config option for this? What's wrong with just using > the sysctl? This way the sysctl can configured directly without needing to have a distro add a new item to sysctl.conf. > Why have you made this option "default y", when enabling it clearly > makes user-visible changes to kernel behaviour? Ingo specifically asked me to make it "default y". -Kees -- Kees Cook ChromeOS Security -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
