On Mon, Aug 26, 2013 at 11:07 AM, Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > On Mon, Aug 26, 2013 at 10:37 AM, Linus Torvalds > <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: >> >> I'm playing with a patch that then in addition to the ptrace check >> *also* requires that the file was opened with the same credentials as >> the follower _or_ the task being followed. I'll see if that works out. > > Chrome sandboxing still _works_ with the attached patch, but there's a > few audit messages about the sandbox being denied dac_read_search. And > I'm really not very happy with this anyway. > > So I'm going to send it out (using email to archive things and see if > anybody has any comments), and then forget about it. > I'm still not thrilled with this approach. I'll see if I can find a clean way to use fmode later today. --Andy > Linus -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
