disallow modular capabilities - linux.kernel

Message from discussion disallow modular capabilities

Christoph Hellwig

View profile

More options Jan 2 2005, 3:10 pm

Newsgroups: linux.kernel

From: Christoph Hellwig <h...@lst.de>

Date: Sun, 02 Jan 2005 21:10:08 +0100

Local: Sun, Jan 2 2005 3:10 pm

Subject: [PATCH] disallow modular capabilities

  Reply to author
  |
  Forward
  | Print
  | View thread
  | Show original
  | Report this message
  | Find messages by this author
  

There's been a bugtraq report about a root exploit with modular
capabilities LSM support out for more than a week.

This patch fixes it the hard way by disallowing to build the code
modular. In fact I think allowing modular security policies is a
really, really bad idea because loading it after boot loses far
too much state. Would you take a patch killing the exports in
security/ ?

--- 1.10/security/Kconfig 2004-10-20 10:37:08 +02:00
+++ edited/security/Kconfig 2005-01-02 20:50:35 +01:00
@@ -54,7 +54,7 @@
If you are unsure how to answer this question, answer N.

config SECURITY_CAPABILITIES
- tristate "Default Linux Capabilities"
+ bool "Default Linux Capabilities"
depends on SECURITY
help
This enables the "default" Linux capabilities functionality.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Reply to author Forward