linux-kernel - Re: [RFC] add mount options to sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 19 May 2011 10:26:23 +0400
From:	Vasiliy Kulikov <segoon@...nwall.com>
To:	Greg KH <gregkh@...e.de>
Cc:	linux-kernel@...r.kernel.org, Kees Cook <kees.cook@...onical.com>,
	Eugene Teo <eugeneteo@...il.com>
Subject: Re: [RFC] add mount options to sysfs

On Wed, May 18, 2011 at 12:17 -0700, Greg KH wrote:
> > 1) *IF* another sensitive file with weird permissions is found, mount
> > option is IMO the best temporary workaround.
> 
> Maybe, but fixing the file would be the obvious solution.

I mean for a sysadmin, not for a developer.

What do you mean by "breaking system"?  Root is able to chmod
and chown sysfs files already, he may do "chmod -R" or similar.
I suggest sane, race free way to globally restrict permissions *IF* root
wants it.

Here https://lkml.org/lkml/2011/2/25/300 you, not aware of usefull
applications of world-writable debugfs file, agreeded to statically
restrict permissions of all files.  I suggest more flexible and
configurable in runtime solution.  It doesn't break anything - default
behaviour doesn't differ from current one.  What has changed in your
mind since 2/25?

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/