Re: sys_setpriority error

Previous message: Chris Wright: "2001_05_30 patch against 2.4.5"
In reply to: Titus D. Winters: "Re: sys_setpriority error"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

chrisat_private

* Titus D. Winters (titusat_private) wrote:
> > I understand what your driving at.  But I hesitate to make logic changes to
> > the kernel.  Consider original code reads...
> >
> >   if (p->uid != current->euid &&
> >      p->uid != current->uid && !capable(CAP_SYS_NICE)) {
> >
> > This really doesn't have any test for root.  just checks that both your uid
> > and euid don't match the target process's uid _and_ you aren't capable.
> 
> Well, if that is the way it is in the kernel, that's good.  Still, since
> we are changing the entire capabilities system anyway, it is a nice time
> to make the system a bit smarter.

I am reluctant to change logic in the kernel when I don't have a complete
understanding for the rationale for why it is the way it is now.  Call me
paranoid, but subtle logic changes easily == security bugs.

As a side note.  Roy's proposal could incorrectly assign 0 to error

> But I agree, if we are not going to watch for stuff like this then we
> really need to examine the dummy functions.  : )

Ooh, that sounds like a volunteer ;-)

-chris

_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module