Re: [security]: kernel ioctl()'s [3]

Theodore Y. Ts'o (tytso@mit.edu)
Thu, 1 Jul 1999 21:04:36 -0400


Date: Fri, 2 Jul 1999 00:03:52 +0100 (BST)
From: Alan Cox <alan@lxorguk.ukuu.org.uk>

> reasonable thing to do. It should get applied to the 2.3 tree, and
> perhaps to the 2.2 tree (it really isn't a bug fix as much as it is a
> new feature, although it's fairly low risk as new features go).

I think its out of the question for 2.2, too much software knows it can
write to users files as root. You've just broken that unix tradition (quite
possibly sensibly broken)

That patch I was referring to doesn't change anything for non-capability
systems. Root can set the immutable flag; non-root user id's can't. So
it doesn't really change much. The only change it makes is that if you
only have CAP_IMMUTABLE, you can only set/clear the immutable and
append-only flag on your own files. You need to have CAP_FOWNER to
change the immutable/append-only flags on all files. Root, of course,
has both capabilities. Non-root users by default have neither, so it
doesn't change the normal behaviour at all.

Alex Viro's request to supply user-settable (and clearable)
immutable/append-only flags for BSD compatibility would be a pretty
significant change, and that definitely would be a 2.3 only sort of
change. Yes, it does break the Unix tradition, and there are times when
it can be useful but given that anyone can set user-settable immutable
flag, it's not *that* different from the removing write-access via the
Unix permissions bit, except it uses a non-standard, non-POSIX
interface. (Yes, I realize there are a few differences, such as it
prevents unlinking the file, and you can't do that without changing the
permissions on the containing directory, which you might not own.)

Still, it's one of those things where the argument for adding a new
user-settable immutable flag is probably strongest based on BSD 4.4
derivitive compatibility, more than its own inherent usefulness.
Comments?

- Ted

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/