On Wednesday 2010-08-25 09:09, Luciano Coelho wrote:
>>
>> Indeed so. But you did not invent any new interface. You are reusing
>> files, which can be protected by DAC modes, or LSMs doing
>> funky-stuff. xt_{condition,recent,..} already implement file modes,
>> but does it check for it? Well no, because fs/namei.c does it for
>> them. As for LSMs, well, I hope they do cater for testing for
>> capability bits.
>
>I dug deeper into the code and I can see that /sys/net has capability
>checks (implemented in netdev_store() in net-sysfs.c) and nobody without
>CAP_NET_ADMIN will be able to write to the files there. But in procfs I
>couldn't see anything similar and anyone with file write permissions can
>modify the files in /proc/net/*.
I did not say there was. fs/ will handle the DAC part, and if you
wanted MAC/capability checking/other sparkles, an LSM sounds like
the right spot.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
