On Fri, Aug 10, 2018 at 10:02:17PM +0300, Dan Carpenter wrote: > On Fri, Aug 10, 2018 at 09:09:31AM -0700, Darrick J. Wong wrote: > > On Fri, Aug 10, 2018 at 12:22:29PM +0300, Dan Carpenter wrote: > > > Hi XFS devs, > > > > > > We received this email on security@xxxxxxxxxx. This is under > > > CAP_SYS_ADMIN, but it maybe should also check with selinux? > > > > Hmm, so the point of adding a security_inode_readlink call would be to > > restrict userland access xfs_readlink_by_handle further in case the > > system has a policy whereby even possessing CAP_SYS_ADMIN is not by > > itself sufficient to be able to read a symlink? > > > > IOWs, are there security policies where CAP_SYS_ADMIN isn't a "get > > access to everything" wildcard? I imagine the answer is "yes" and > > therefore xfs needs the call, but I thought I'd ask first. > > > > Yeah... Forget about it. I pushed this out to you without really > thinking about it, just to get it off my todo list and that wasn't the > right thing. > Just thought it was worth to mention... A long time ago, I've seen implementations where the system administration was split between a sys admin and a 'security admin', where the security admin removed some root permissions, and so, some very specific tasks could only be done by the security admin. All these were enforced by selinux. Although, I don't see such implementations in ages, I still think they are out there. Cheers > regards, > dan carpenter -- Carlos
