Subject: Re: Getting rid of /dev/veriexec
To: matthew green <firstname.lastname@example.org>
From: Bill Studenmund <email@example.com>
Date: 12/02/2005 15:33:04
Content-Type: text/plain; charset=us-ascii
On Sat, Dec 03, 2005 at 10:18:20AM +1100, matthew green wrote:
> > Nathan J. Williams wrote:
> > > I object to those, too.
> > Why?
> The same reason; I don't like sysctl being used for things other than
> individual knobs. I'm OK with sysctl(8) as a UI, but I don't think
> that sysctl(3) does much but duplicate other infrastructure - namely,
> the filesystem.
> while i agree that using sysctl for "control" interface is not
> perhaps the right thing, using it to export data is something
> that's been true for a long time and using it to remove set-id
> bits from various apps has been a goal of the project for a
> long time. it's not just security, either - it means that ps(1)
> works always now, even 32 bit ps(1) 64 bit kernel.
To be honest, I wish we didn't use sysctl here. I think it is an abuse of
the interface. I think there are ways we could have done the same thing=20
with other methods.
That said, while I don't like what we have done with sysctl here, I think=
it's MUCH better that the set-id code we had. Adding structure to the data=
access is a good thing. :-)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (NetBSD)
-----END PGP SIGNATURE-----