[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <1248193394.2654.327.camel@localhost>
Date: Tue, 21 Jul 2009 12:23:14 -0400
From: Eric Paris <eparis@...hat.com>
To: Alan Cox <alan@...rguk.ukuu.org.uk>
Cc: linux-kernel@...r.kernel.org, selinux@...ho.nsa.gov,
linux-security-module@...r.kernel.org, sds@...ho.nsa.gov,
jmorris@...ei.org, spender@...ecurity.net, dwalsh@...hat.com,
cl@...ux-foundation.org, arjan@...radead.org, kyle@...artin.ca,
cpardy@...hat.com, arnd@...db.de
Subject: Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all
mmap_zero operations
On Tue, 2009-07-21 at 17:09 +0100, Alan Cox wrote:
> It's a really ugly problem that almost begs for better hardware
> facilities (such as the multiple independent address spaces in some
> processors)
If only we knew someone who worked at intel..... *smile*
Are you on board with the change I propose as long as I make the address
space controlled by SELinux tunable instead of fixed at one page? Thus
allowing one to maintain the status quo? Yeah, still sucks for
non-selinux systems and wine, but at least there can be hardening
against a non-root local authenticated user on a default fedora
install...
-Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists