On Mon, Jan 25, 2016 at 11:33 AM, Eric W. Biederman <ebiederm@xxxxxxxxxxxx> wrote: > Kees Cook <keescook@xxxxxxxxxxxx> writes: >> >> Well, I don't know about less weird, but it would leave a unneeded >> hole in the permission checks. > > To be clear the current patch has my: > > Nacked-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> > > The code is buggy, and poorly thought through. Your lack of interest in > fixing the bugs in your patch is distressing. I'm not sure where you see me having a "lack of interest". The existing cap-checking sysctls have a corner-case bug, which is orthogonal to this change. > So broken code, not willing to fix. No. We are not merging this sysctl. I think you're jumping to conclusions. :) This feature is already implemented by two distros, and likely wanted by others. We cannot ignore that. The sysctl default doesn't change the existing behavior, so this doesn't get in your way at all. Can you please respond to my earlier email where I rebutted each of your arguments against it? Just saying "no" and putting words in my mouth isn't very productive. Andy, given your interest in this feature, and my explanation of the CAP_SYSADMIN check, what are your thoughts? -Kees -- Kees Cook Chrome OS & Brillo Security -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
