Date: Mon, 25 Jan 2016 14:34:32 -0800 From: Kees Cook <keescook@...omium.org> To: "Eric W. Biederman" <ebiederm@...ssion.com> Cc: Andy Lutomirski <luto@...capital.net>, Andrew Morton <akpm@...ux-foundation.org>, Al Viro <viro@...iv.linux.org.uk>, Richard Weinberger <richard@....at>, Robert Święcki <robert@...ecki.net>, Dmitry Vyukov <dvyukov@...gle.com>, David Howells <dhowells@...hat.com>, Miklos Szeredi <mszeredi@...e.cz>, Kostya Serebryany <kcc@...gle.com>, Alexander Potapenko <glider@...gle.com>, Eric Dumazet <edumazet@...gle.com>, Sasha Levin <sasha.levin@...cle.com>, "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com> Subject: Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled On Mon, Jan 25, 2016 at 11:33 AM, Eric W. Biederman <ebiederm@...ssion.com> wrote: > Kees Cook <keescook@...omium.org> writes: >> >> Well, I don't know about less weird, but it would leave a unneeded >> hole in the permission checks. > > To be clear the current patch has my: > > Nacked-by: "Eric W. Biederman" <ebiederm@...ssion.com> > > The code is buggy, and poorly thought through. Your lack of interest in > fixing the bugs in your patch is distressing. I'm not sure where you see me having a "lack of interest". The existing cap-checking sysctls have a corner-case bug, which is orthogonal to this change. > So broken code, not willing to fix. No. We are not merging this sysctl. I think you're jumping to conclusions. :) This feature is already implemented by two distros, and likely wanted by others. We cannot ignore that. The sysctl default doesn't change the existing behavior, so this doesn't get in your way at all. Can you please respond to my earlier email where I rebutted each of your arguments against it? Just saying "no" and putting words in my mouth isn't very productive. Andy, given your interest in this feature, and my explanation of the CAP_SYSADMIN check, what are your thoughts? -Kees -- Kees Cook Chrome OS & Brillo Security
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.