Hi Christoph, On Mon, May 31, 2010 at 06:35:10AM -0400, Christoph Hellwig wrote: > NAK for changing this in core code. These are long-living and > documented semantics that we can't simply break, and as Alan mentioned > having there's good enough workaround that don't break applications. I totally disagree -- there are no applications that depend on this behavior in sticky world-writable directories. Adding this logic (where ever it lands) fixes /tmp symlink races forever and breaks nothing. > Feel free to shovel it into the crackpot LSM of your choice. I have no strong opinion about where it should live. The strong opinion I have is that all Linux users, regardless of LSM choice, should benefit from the fix. I'd like to separate objections about implementation from objections about the change in semantics itself. If every user of Linux gains this symlink protection, does it matter if it's in core VFS or in commoncaps? Expecting the push-back from VFS, I wrote this patch against commoncaps. James, would you take it there (along with the patch to SELinux to call out to commoncaps) if there is no way to proceed with the VFS core towards solving this? Thanks, -Kees -- Kees Cook Ubuntu Security Team -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
