From: "Theodore Y. Ts'o" <tytso@mit.edu>
To: Topi Miettinen <toiwoton@gmail.com>
Cc: Luis Chamberlain <mcgrof@kernel.org>,
Kees Cook <keescook@chromium.org>,
Alexey Dobriyan <adobriyan@gmail.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"open list:FILESYSTEMS (VFS and infrastructure)"
<linux-fsdevel@vger.kernel.org>
Subject: Re: [PATCH] Allow restricting permissions in /proc/sys
Date: Sun, 3 Nov 2019 12:56:48 -0500 [thread overview]
Message-ID: <20191103175648.GA4603@mit.edu> (raw)
In-Reply-To: <74a91362-247c-c749-5200-7bdce704ed9e@gmail.com>
On Sun, Nov 03, 2019 at 04:55:48PM +0200, Topi Miettinen wrote:
> Several items in /proc/sys need not be accessible to unprivileged
> tasks. Let the system administrator change the permissions, but only
> to more restrictive modes than what the sysctl tables allow.
>
> Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
Why should restruct the system administrator from changing the
permissions to one which is more lax than what the sysctl tables?
The system administrator is already very much trusted. Why should we
take that discretion away from the system administrator?
- Ted
next prev parent reply other threads:[~2019-11-03 17:56 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-03 14:55 [PATCH] Allow restricting permissions in /proc/sys Topi Miettinen
2019-11-03 17:56 ` Theodore Y. Ts'o [this message]
2019-11-03 19:24 ` Topi Miettinen
2019-11-12 23:15 ` Kees Cook
2019-11-03 18:50 ` Eric W. Biederman
2019-11-03 19:38 ` Topi Miettinen
2019-11-04 15:44 ` Eric W. Biederman
2019-11-04 17:58 ` Topi Miettinen
2019-11-04 23:41 ` Eric W. Biederman
2019-11-05 7:35 ` Topi Miettinen
2019-11-12 23:19 ` Kees Cook
2019-11-13 1:04 ` Luis Chamberlain
2019-11-12 23:22 ` Christian Brauner
2019-11-13 4:50 ` Andy Lutomirski
2019-11-13 10:52 ` Topi Miettinen
2019-11-13 16:00 ` Jann Horn
2019-11-13 16:19 ` Topi Miettinen
2019-11-13 16:40 ` Jann Horn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191103175648.GA4603@mit.edu \
--to=tytso@mit.edu \
--cc=adobriyan@gmail.com \
--cc=keescook@chromium.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mcgrof@kernel.org \
--cc=toiwoton@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).