Yes - I need noacl and nouser_xattr
How about documenting your intent to remove them in the man pages.
acl support and user_xattr support need to be off on the / and /usr
filesystems to simplify security. Actually I want a way to turn off ALL
extended attribute support on any filesystem. How about noxattr (which
would turn off ALL extended attribute support including acls). I also
use nosuid on filesystems that shouldn't have any suid files.
This is to follow the security principal - "If you aren't using it and
don't need it - turn it off".
The simple Posix/Unix permissions are more than enough security control
in almost every situation I have run into (only wish I could use them in
Windows).
Having worked extensively with ACLS on Windows (and some older Main
Frame OSes) - I note that ACL's add a level of complexity to security
that actually makes for less security. I see the need to support them
in Unix/Linux - but they should be OFF unless someone specifically wants
to use them (at least don't make them hard to turn off).
Just try auditing the security of a windows filesystem if you don't
think ACL's add extreme complexity (I gave up - I just forcibily set all
the ACL's myself by script using the unix Owner,Group,Other concepts as
a model to simplify what I am setting).
--
---------------------------------------------------------------------
The views and opinions expressed above are strictly
those of the author(s). The content of this message has
not been reviewed nor approved by any entity whatsoever.
I should not be considered an "AUTHORITY" on any subject.
---------------------------------------------------------------------
Paul Markfort Info: http://www.umn.edu/~paulfm
---------------------------------------------------------------------
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
