From: Andy Lutomirski Subject: Re: General flags to turn things off (getrandom, pid lookup, etc) Date: Fri, 25 Jul 2014 14:41:47 -0700 Message-ID: References: <20140725223550.3153f436@alan.etchedpixels.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: "Eric W. Biederman" , Julien Tinnes , David Drysdale , Al Viro , Paolo Bonzini , LSM List , Greg Kroah-Hartman , Paul Moore , James Morris , Linux API , Meredydd Luff , Christoph Hellwig , "linux-kernel@vger.kernel.org" , Kees Cook , "Theodore Ts'o" , Henrique de Moraes Holschuh , linux-crypto@vger.kernel.org To: One Thousand Gnomes Return-path: Received: from mail-lb0-f180.google.com ([209.85.217.180]:35975 "EHLO mail-lb0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751247AbaGYVmJ (ORCPT ); Fri, 25 Jul 2014 17:42:09 -0400 Received: by mail-lb0-f180.google.com with SMTP id v6so3803386lbi.39 for ; Fri, 25 Jul 2014 14:42:07 -0700 (PDT) In-Reply-To: <20140725223550.3153f436@alan.etchedpixels.co.uk> Sender: linux-crypto-owner@vger.kernel.org List-ID: On Fri, Jul 25, 2014 at 2:35 PM, One Thousand Gnomes wrote: > On Fri, 25 Jul 2014 11:30:48 -0700 > Andy Lutomirski wrote: > >> [new thread because this sort of combines two threads] >> >> There is recent interest in having a way to turn generally-available >> kernel features off. Maybe we should add a good one so we can stop >> bikeshedding and avoid proliferating dumb interfaces. > > We sort of have one. It's called capable(). Just needs extending to cover > anything else you care about, and probably all the numeric constants > replacing with textual names. > Except that it's all backwards: these are things that default to *on*, and people might want them to turn off. capable() is totally fscked if you want otherwise unprivileged users to carry capabilities around, and fixing it seems to run into endless claims that the "capability" system is carefully designed, flawless, perfect, ideal, amazing, and shouldn't be changed, despite the fact that it's empirically damn near useless. Also, capabilities do the wrong thing wrt namespaces. The things I'm talking about aren't namespaced. They're either on or off. --Andy