From: Kees Cook <kees.cook@canonical.com>
To: "Serge E. Hallyn" <serge@hallyn.com>
Cc: James Morris <jmorris@namei.org>, Eric Paris <eparis@redhat.com>,
Stephen Smalley <sds@tycho.nsa.gov>,
dwalsh@redhat.com, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] syslog: check cap_syslog when dmesg_restrict
Date: Wed, 8 Dec 2010 09:53:16 -0800 [thread overview]
Message-ID: <20101208175316.GL5750@outflux.net> (raw)
In-Reply-To: <20101208151901.GA20557@mail.hallyn.com>
On Wed, Dec 08, 2010 at 03:19:01PM +0000, Serge E. Hallyn wrote:
> Eric Paris pointed out that it doesn't make sense to require
> both CAP_SYS_ADMIN and CAP_SYSLOG for certain syslog actions.
> So require CAP_SYSLOG, not CAP_SYS_ADMIN, when dmesg_restrict
> is set.
>
> (I'm also consolidating the now common error path)
>
> Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
--
Kees Cook
Ubuntu Security Team
next prev parent reply other threads:[~2010-12-08 17:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-12-08 15:19 [PATCH] syslog: check cap_syslog when dmesg_restrict Serge E. Hallyn
2010-12-08 15:39 ` Eric Paris
2010-12-08 16:42 ` Serge E. Hallyn
2010-12-08 16:46 ` Eric Paris
2010-12-08 17:53 ` Kees Cook [this message]
2010-12-08 22:56 ` James Morris
2010-12-10 14:02 ` Daniel J Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20101208175316.GL5750@outflux.net \
--to=kees.cook@canonical.com \
--cc=dwalsh@redhat.com \
--cc=eparis@redhat.com \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.