Re: [PATCH] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-04 Thread Aleksa Sarai
Previously, the only capability effectively required to operate on the /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, having an fsuid of GLOBAL_ROOT_UID was enough). This means that semi-privileged processes could interfere with core components of a system (such as causing a

Re: [PATCH] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-04 Thread Aleksa Sarai
Previously, the only capability effectively required to operate on the /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, having an fsuid of GLOBAL_ROOT_UID was enough). This means that semi-privileged processes could interfere with core components of a system (such as causing a

Re: [PATCH] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-04 Thread Randy Dunlap
On 11/04/2017 11:59 AM, Aleksa Sarai wrote: > Previously, the only capability effectively required to operate on the > /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, > having an fsuid of GLOBAL_ROOT_UID was enough). This means that > semi-privileged processes could interfere

Re: [PATCH] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-04 Thread Randy Dunlap
On 11/04/2017 11:59 AM, Aleksa Sarai wrote: > Previously, the only capability effectively required to operate on the > /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, > having an fsuid of GLOBAL_ROOT_UID was enough). This means that > semi-privileged processes could interfere

[PATCH] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-04 Thread Aleksa Sarai
Previously, the only capability effectively required to operate on the /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, having an fsuid of GLOBAL_ROOT_UID was enough). This means that semi-privileged processes could interfere with core components of a system (such as causing a

[PATCH] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-04 Thread Aleksa Sarai
Previously, the only capability effectively required to operate on the /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, having an fsuid of GLOBAL_ROOT_UID was enough). This means that semi-privileged processes could interfere with core components of a system (such as causing a