Re: [PATCH 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zerooperations

[Alan Cox]

On Tue, 21 Jul 2009 12:23:14 -0400
Eric Paris <eparis@xxxxxxxxxx> wrote:

> On Tue, 2009-07-21 at 17:09 +0100, Alan Cox wrote:
> 
> > It's a really ugly problem that almost begs for better hardware
> > facilities (such as the multiple independent address spaces in some
> > processors)
> 
> If only we knew someone who worked at intel.....   *smile*
> 
> Are you on board with the change I propose as long as I make the address
> space controlled by SELinux tunable instead of fixed at one page?  Thus
> allowing one to maintain the status quo?  Yeah, still sucks for
> non-selinux systems and wine, but at least there can be hardening
> against a non-root local authenticated user on a default fedora
> install...

I don't like it much, but I have exactly zero better ideas. It's also
your area of expertise not mine, so I'm not going to object further.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/