[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOSRhRMb5htcjczxk5WaE-0EQxTLO1o_KZz=HRFik4nKthi4mg@mail.gmail.com>
Date: Thu, 27 Oct 2011 16:58:18 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- kernel: sysctl: restrict write
access to dmesg_restrict
>>
>> I also agree with Vasiliy's point that LXC security boundaries in the
>> mainline kernel are not well defined at this point, so the whole thing
>> is a bit silly.
>
> Just wondering - do you usually ack patches that you consider silly?
>
Just because a patch doesn't fix an immediate problem right now
doesn't mean it isn't the right thing to do. For consistency's sake,
it makes sense that it should require CAP_SYS_ADMIN to modify this
sysctl, and it's certainty not a bad idea to move towards a more
well-defined security boundary for LXC for the future. That's why I
ack'ed the patch. I simply meant that assigning a CVE for this case
was silly because it doesn't represent a violation of a real security
boundary.
-Dan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
