Re: [PATCH 2/7] procfs privacy: tasks/processes lookup
Lorenzo Hernández García-Hierro schrieb: > This patch restricts non-root users to view only their own processes. You may also want to have a look at the patches I submitted over the last few weeks that restricted some file permissions in /proc// and the comments I received. Regards, Rene - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 2/7] procfs privacy: tasks/processes lookup
El lun, 18-04-2005 a las 15:24 -0400, Rik van Riel escribió: > This looks like a very bad default to me! > > Your patch would force people to run system monitoring > applications as root, because otherwise they cannot get > some of the information they can get now. Forcing that > these applications run with root rights is a security > risk, not a benefit... Right, that's why I would say "fall back to the config. option" behavior, trusting in a certain user group defined in configuration-time or via sysctl, or just keeping it simple as it's right now, split up so anyone can decide what to apply and what shouldn't be applied. Cheers, -- Lorenzo Hernández García-Hierro <[EMAIL PROTECTED]> [1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org] signature.asc Description: This is a digitally signed message part
Re: [PATCH 2/7] procfs privacy: tasks/processes lookup
On Mon, 18 Apr 2005, Lorenzo Hernández García-Hierro wrote: > This patch restricts non-root users to view only their own processes. This looks like a very bad default to me! Your patch would force people to run system monitoring applications as root, because otherwise they cannot get some of the information they can get now. Forcing that these applications run with root rights is a security risk, not a benefit... -- "Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it." - Brian W. Kernighan
