[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: pthread_setaffinity_np() permissions / secmodel sysctl(7)s
On Fri, 04 Nov 2011 01:39:45 +0100, Jean-Yves Migeon wrote:
On 03.11.2011 10:38, Jean-Yves Migeon wrote:
On Wed, 2 Nov 2011 22:36:58 -0400, Thor Lancelot Simon wrote:
On Thu, Nov 03, 2011 at 03:30:54AM +0100, Jean-Yves Migeon wrote:
Should not? I took the same logic as the one allowing usermounts.
It's a matter of policy though.
None of the security sysctls should be changeable at securelevel 1
higher. Certainly it should not be possible to grant additional
to non-root users. Is there logic somewhere else preventing it,
in the relevant kauth listener perhaps?
None, the checks are simply not implemented in
I'll have a look this evening.
This has to be done for each variable though depending on their use:
usermount/usersetaffinity cases, it's reasonable to deny additional
rights to non-root users, but turning off these rights should still
permitted even when securelevel is set to 1+.
I hit an interesting scenario here -- an interdependency problem
between secmodel modules.
FWIW I received a private reply from Elad with an API proposal (not yet
implemented, so I'll look into it).
Main Index |
Thread Index |