Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Oct 2011 16:58:18 -0400
From: Dan Rosenberg <>
Subject: Re: CVE Request -- kernel: sysctl: restrict write
 access to dmesg_restrict

>> I also agree with Vasiliy's point that LXC security boundaries in the
>> mainline kernel are not well defined at this point, so the whole thing
>> is a bit silly.
> Just wondering - do you usually ack patches that you consider silly?

Just because a patch doesn't fix an immediate problem right now
doesn't mean it isn't the right thing to do.  For consistency's sake,
it makes sense that it should require CAP_SYS_ADMIN to modify this
sysctl, and it's certainty not a bad idea to move towards a more
well-defined security boundary for LXC for the future.  That's why I
ack'ed the patch.  I simply meant that assigning a CVE for this case
was silly because it doesn't represent a violation of a real security


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.