Re: [PATCH 2/2] debugfs: only allow root access to debugginginterfaces

[Kees Cook]

On Tue, Feb 22, 2011 at 07:34:18PM +0000, Alan Cox wrote:
> Anyway - we don't mostly have a "root/non-root" model - it went out
> around Linux 1.2. So any model for dealing with should be respecting of
> capabilities, SELinux and the like.

That reminds me; in this line of reasoning, would a patchset to update all
the /proc/sys, /sys, etc writing functions to take capability lists and check
them be accepted? Because right now, almost everything in /proc/sys uses
DAC instead of checking caps. I think the same is true of /sys and debugfs.

-Kees

-- 
Kees Cook
Ubuntu Security Team
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/