Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-24 Thread Michael Kerrisk (man-pages)
>> This means a listener may have read authorization for /home and mark >> this mount. >> Afterwards, while you sign a git tag, it will receive a FAN_OPEN event >> and use the file descriptor supplied in the event to overwrite your >> /home/jankara/.gnupg/secring.pgp >> though the file is chmod 600

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-24 Thread Jan Kara
On Thu 24-04-14 15:54:06, Heinrich Schuchardt wrote: > On 24.04.2014 11:04, Jan Kara wrote: > >On Tue 22-04-14 16:07:47, Jan Kara wrote: > >>On Tue 22-04-14 15:50:26, Michael Kerrisk (man-pages) wrote: > >>>On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara wrote: > On Sat 19-04-14 22:53:53, Heinrich S

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-24 Thread Michael Kerrisk (man-pages)
On Thu, Apr 24, 2014 at 3:54 PM, Heinrich Schuchardt wrote: > On 24.04.2014 11:04, Jan Kara wrote: >> >> On Tue 22-04-14 16:07:47, Jan Kara wrote: >>> >>> On Tue 22-04-14 15:50:26, Michael Kerrisk (man-pages) wrote: On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara wrote: > > On Sat 19-

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-24 Thread Heinrich Schuchardt
On 24.04.2014 11:04, Jan Kara wrote: On Tue 22-04-14 16:07:47, Jan Kara wrote: On Tue 22-04-14 15:50:26, Michael Kerrisk (man-pages) wrote: On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara wrote: On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: When monitoring a directory or a mount with the fa

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-24 Thread Jan Kara
On Tue 22-04-14 22:51:58, Heinrich Schuchardt wrote: > On 22.04.2014 16:07, Jan Kara wrote: > >>>On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: > When monitoring a directory or a mount with the fanotify API > the call to fanotify_init checks, > * the process has cap_sys_admin ca

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-24 Thread Jan Kara
On Tue 22-04-14 16:07:47, Jan Kara wrote: > On Tue 22-04-14 15:50:26, Michael Kerrisk (man-pages) wrote: > > On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara wrote: > > > On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: > > >> When monitoring a directory or a mount with the fanotify API > > >> the ca

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-22 Thread Heinrich Schuchardt
On 22.04.2014 16:07, Jan Kara wrote: On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: When monitoring a directory or a mount with the fanotify API the call to fanotify_init checks, * the process has cap_sys_admin capability The call to fanotify_mark checks, * the process has read author

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-22 Thread Jan Kara
On Tue 22-04-14 15:50:26, Michael Kerrisk (man-pages) wrote: > On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara wrote: > > On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: > >> When monitoring a directory or a mount with the fanotify API > >> the call to fanotify_init checks, > >> * the process has

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-22 Thread Michael Kerrisk (man-pages)
On Tue, Apr 22, 2014 at 3:50 PM, Michael Kerrisk (man-pages) wrote: > On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara wrote: >> On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: >>> When monitoring a directory or a mount with the fanotify API >>> the call to fanotify_init checks, >>> * the process

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-22 Thread Michael Kerrisk (man-pages)
On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara wrote: > On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: >> When monitoring a directory or a mount with the fanotify API >> the call to fanotify_init checks, >> * the process has cap_sys_admin capability >> >> The call to fanotify_mark checks, >> *

Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-22 Thread Jan Kara
On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote: > When monitoring a directory or a mount with the fanotify API > the call to fanotify_init checks, > * the process has cap_sys_admin capability > > The call to fanotify_mark checks, > * the process has read authorization for directory or mount

[PATCH 1/1] fanotify: check permissions when creating file descriptor

2014-04-19 Thread Heinrich Schuchardt
When monitoring a directory or a mount with the fanotify API the call to fanotify_init checks, * the process has cap_sys_admin capability The call to fanotify_mark checks, * the process has read authorization for directory or mount A directory or mount may contain files for which the process ha