[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 Nov 2011 13:23:16 -0800
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: "H. Peter Anvin" <hpa@...or.com>
Cc: Vasiliy Kulikov <segoon@...nwall.com>, Eric Paris <eparis@...isplace.org>,
kernel-hardening@...ts.openwall.com, Valdis.Kletnieks@...edu,
linux-kernel@...r.kernel.org, Alexey Dobriyan <adobriyan@...il.com>,
Andrew Morton <akpm@...ux-foundation.org>, linux-security-module@...r.kernel.org
Subject: Re: Re: [PATCH] proc: restrict access to /proc/interrupts
On Mon, Nov 7, 2011 at 12:47 PM, H. Peter Anvin <hpa@...or.com> wrote:
>
> You didn't really get my point. There are global nodes which are
> dynamic, and more importantly the *set* changes across the system life.
> A global policy option is a lot easier to deal with for the vast
> majority of users who don't need fine grain control.
I want *one* global policy that the kernel would actually know about:
is the user physically at the machine right now.
Sadly, I don't think the kernel has any good way to figure that out
automatically.
Because quite frankly, a lot of the /proc files should be "root or
desktop user". If you control the hardware, you should damn well be
able to see the interrupt counts in order to do bug reports etc
without having to 'sudo' or similar.
I realize that pam & co could give us this info, or we could just add
a new capability flag, but I think this is something where the kernel
really could just do the RightThing(tm) automatically, and screw the
crazy login managers, odd policies (I really don't believe that adding
magic selinux rules actually improves security all that much, because
it's too painful and too hard to know for any normal user).
The person in front of the hardware really *is* fundamentally special.
Right now all the distros do magic things with the audio device
because they know the person in front of the machine is special. But
all those things are ad-hoc per device, and never cover things like
random /proc files etc.
Linus
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
