From: Eric Paris <eparis@redhat.com>
To: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov,
linux-security-module@vger.kernel.org, sds@tycho.nsa.gov,
jmorris@namei.org, spender@grsecurity.net, dwalsh@redhat.com,
cl@linux-foundation.org, arjan@infradead.org, kyle@mcmartin.ca,
cpardy@redhat.com, arnd@arndb.de
Subject: Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero operations
Date: Tue, 21 Jul 2009 12:23:14 -0400 [thread overview]
Message-ID: <1248193394.2654.327.camel@localhost> (raw)
In-Reply-To: <20090721170909.6182230c@lxorguk.ukuu.org.uk>
On Tue, 2009-07-21 at 17:09 +0100, Alan Cox wrote:
> It's a really ugly problem that almost begs for better hardware
> facilities (such as the multiple independent address spaces in some
> processors)
If only we knew someone who worked at intel..... *smile*
Are you on board with the change I propose as long as I make the address
space controlled by SELinux tunable instead of fixed at one page? Thus
allowing one to maintain the status quo? Yeah, still sucks for
non-selinux systems and wine, but at least there can be hardening
against a non-root local authenticated user on a default fedora
install...
-Eric
next prev parent reply other threads:[~2009-07-21 16:24 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-07-21 14:41 [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero operations Eric Paris
2009-07-21 14:42 ` [PATCH 2/2] SELinux: selinux_file_mmap always enforce mapping the 0 page Eric Paris
2009-07-21 15:04 ` [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero operations Alan Cox
2009-07-21 15:18 ` Eric Paris
2009-07-21 15:38 ` Alan Cox
2009-07-21 15:57 ` Eric Paris
2009-07-21 16:09 ` Alan Cox
2009-07-21 16:23 ` Eric Paris [this message]
2009-07-21 16:30 ` Alan Cox
2009-07-29 15:06 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1248193394.2654.327.camel@localhost \
--to=eparis@redhat.com \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=arjan@infradead.org \
--cc=arnd@arndb.de \
--cc=cl@linux-foundation.org \
--cc=cpardy@redhat.com \
--cc=dwalsh@redhat.com \
--cc=jmorris@namei.org \
--cc=kyle@mcmartin.ca \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
--cc=spender@grsecurity.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox