Re: [PATCH 2/2] debugfs: only allow root access to debugging interfaces

Kees Cook
2011-02-22T19:55:17Z

On Tue, Feb 22, 2011 at 07:34:18PM +0000, Alan Cox wrote:
> Anyway - we don't mostly have a "root/non-root" model - it went out
> around Linux 1.2. So any model for dealing with should be respecting of
> capabilities, SELinux and the like.

That reminds me; in this line of reasoning, would a patchset to update all
the /proc/sys, /sys, etc writing functions to take capability lists and check
them be accepted? Because right now, almost everything in /proc/sys uses
DAC instead of checking caps. I think the same is true of /sys and debugfs.

-Kees

--
Kees Cook
Ubuntu Security Team