linux-kernel - Re: [PATCH v6] fs: allow protected cross-uid sticky symlinks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20100608092554.34e9296f@lxorguk.ukuu.org.uk>
Date:	Tue, 8 Jun 2010 09:25:54 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Kees Cook <kees.cook@...onical.com>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Valdis.Kletnieks@...edu, Dave Young <hidave.darkstar@...il.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	Eric Paris <eparis@...hat.com>,
	Christoph Hellwig <hch@...radead.org>,
	James Morris <jmorris@...ei.org>, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, linux-doc@...r.kernel.org,
	Randy Dunlap <rdunlap@...otime.net>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Jiri Kosina <jkosina@...e.cz>,
	Martin Schwidefsky <schwidefsky@...ibm.com>,
	David Howells <dhowells@...hat.com>,
	Ingo Molnar <mingo@...e.hu>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Tim Gardner <tim.gardner@...onical.com>,
	"Serge E. Hallyn" <serue@...ibm.com>, tytso@....edu
Subject: Re: [PATCH v6] fs: allow protected cross-uid sticky symlinks

> For the people objecting to the actual code of the patch, I'm very
> interested in finding a solution.  I am obviously not a Linux kernel VFS
> maintainer.  I'm very keen to find an acceptable version of the patch
> based on feedback from those that know this area of the kernel intimately.

You've already had those suggestions some days ago. Use a security module,
either by using something like SELinux (where you can do this just fine
as far as I can see including exceptions by label for problem apps), or
write your own little seucrity module that does it. Or for that matter
just leave it as an Ubuntu patch.

Since you didn't seem t get the hint earlier I also suspecifically NAK the
current patch.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/