Re: [PATCH v3] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-09 Thread Eric W. Biederman
Aleksa Sarai writes: > On 11/05/2017 01:56 PM, Aleksa Sarai wrote: >> Previously, the only capability effectively required to operate on the >> /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, >> having an fsuid of GLOBAL_ROOT_UID was enough). This means that >> semi-privileged

Re: [PATCH v3] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-05 Thread Greg KH
A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing? A: Top-posting. Q: What is the most annoying thing in e-mail? A: No. Q: Should I include quotations after my reply? http://daringfireball.net/2007/07/on_top On Sun, Nov 05, 2017 at 08:1

Re: [PATCH v3] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-05 Thread Aleksa Sarai
I've booted it on a few of my laptops, and nothing seemed to break. Is there a particular test-suite you'd recommend that I run? On Sun, Nov 5, 2017 at 6:31 PM, Greg KH wrote: > On Sun, Nov 05, 2017 at 01:56:35PM +1100, Aleksa Sarai wrote: >> Previously, the only capability effectively required t

Re: [PATCH v3] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-05 Thread Greg KH
On Sun, Nov 05, 2017 at 01:56:35PM +1100, Aleksa Sarai wrote: > Previously, the only capability effectively required to operate on the > /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, > having an fsuid of GLOBAL_ROOT_UID was enough). This means that > semi-privileged processes

Re: [PATCH v3] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-04 Thread Aleksa Sarai
On 11/05/2017 01:56 PM, Aleksa Sarai wrote: Previously, the only capability effectively required to operate on the /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, having an fsuid of GLOBAL_ROOT_UID was enough). This means that semi-privileged processes could interfere with cor

[PATCH v3] scsi: require CAP_SYS_ADMIN to write to procfs interface

2017-11-04 Thread Aleksa Sarai
Previously, the only capability effectively required to operate on the /proc/scsi interface was CAP_DAC_OVERRIDE (or for some other files, having an fsuid of GLOBAL_ROOT_UID was enough). This means that semi-privileged processes could interfere with core components of a system (such as causing a Do