lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240104112752.120cb566@gandalf.local.home>
Date: Thu, 4 Jan 2024 11:27:52 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Petr Mladek <pmladek@...e.com>
Cc: Greg KH <gregkh@...uxfoundation.org>, 孟敬姿
 <mengjingzi@....ac.cn>, john.ogness@...utronix.de,
 senozhatsky@...omium.org, keescook@...omium.org, tony.luck@...el.com,
 gpiccoli@...lia.com, linux-hardening@...r.kernel.org,
 linux-kernel@...r.kernel.org, Linus Torvalds <torvalds@...uxfoundation.org>
Subject: Re: Suggestion for Capability Check Refinement in
 check_syslog_permissions()

On Thu, 4 Jan 2024 10:43:53 +0100
Petr Mladek <pmladek@...e.com> wrote:

> And CAP_SYS_ADMIN has really been deprecated last 13 years, see the
> commit ee24aebffb75a7f940cf ("cap_syslog: accept CAP_SYS_ADMIN for now").
> 
> Maybe, it is really time to remove it.

Perhaps what we should do is to remove it in a simple change that can be
easily reverted if someone complains.

The point is, Linus always says "Don't break user space", but he has even
said that we have broken user API before, but as long as no user space
breaks, it's OK. It's the "tree falls in the forest" analogy. If we break
user space API, but no user space application uses it, did it really break?

If nothing is using CAP_SYS_ADMIN why keep it?

If we remove it, and nobody complains, it means that nothing broke. If we
remove it and someone complains, then we know it's still needed and we
revert the removal just like Linus would do with any other commit that
broke user space.

-- Steve

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ