From: Hannes Frederic Sowa <hannes@stressinduktion.org>
To: Florian Westphal <fw@strlen.de>
Cc: Ben Hutchings <ben@decadent.org.uk>,
netdev <netdev@vger.kernel.org>,
Vasiliy Kulikov <segoon@openwall.com>
Subject: Re: [RFC][PATCH] IP: Make ping sockets optional
Date: Thu, 24 Apr 2014 17:17:48 +0200 [thread overview]
Message-ID: <20140424151748.GH1960@order.stressinduktion.org> (raw)
In-Reply-To: <20140423162712.GB13717@breakpoint.cc>
On Wed, Apr 23, 2014 at 06:27:12PM +0200, Florian Westphal wrote:
> Ben Hutchings <ben@decadent.org.uk> wrote:
> > Userspace can't assume it now because access is controlled by a sysctl.
> >
> > I think it is for distributions to choose whether to enable this feature
> > in ping and the kernel.
>
> I am not (yet) buying this argument.
>
> Saying 'you need to change sysctl foo for this to work' in a program manpage
> is a lot different than 'you need to recompile the kernel'.
Maybe we can make the Kconfig option depend on CONFIG_EMBEDDED so that we can
be sure people don't have man-pages on the device. ;)
Seriously, I think doing authorization check based on gids in a sysctl is
wrong. Switching over to capabilities seems to make this interface much
more useable to me. But we would need to make sure, that we don't suddenly
allow people to use those sockets where it was restricted previously.
Greetings,
Hannes
next prev parent reply other threads:[~2014-04-24 15:17 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-23 15:20 [RFC][PATCH] IP: Make ping sockets optional Ben Hutchings
2014-04-23 15:30 ` Florian Westphal
2014-04-23 15:55 ` Ben Hutchings
2014-04-23 16:27 ` Florian Westphal
2014-04-24 15:17 ` Hannes Frederic Sowa [this message]
2014-04-24 16:02 ` Ben Hutchings
2014-04-24 16:37 ` Hannes Frederic Sowa
2014-04-25 10:37 ` Lorenzo Colitti
2014-04-25 21:18 ` Hannes Frederic Sowa
2014-04-26 3:02 ` Lorenzo Colitti
2014-04-25 21:43 ` Ben Hutchings
2014-04-23 16:05 ` David Laight
2014-04-24 15:59 ` Lorenzo Colitti
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140424151748.GH1960@order.stressinduktion.org \
--to=hannes@stressinduktion.org \
--cc=ben@decadent.org.uk \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=segoon@openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).