: security: filesystem capabilities (was Re: [PATCH] capabilities: refactor kernel code + bugfix)
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest4 patches 16 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/4 | security: filesystem capabilities bugfix1fs/ include/ include/ +1 more | +54 | 5 replies | |
| 2/4 | security: filesystem capabilities bugfix2security/ | +10 | 8 replies | |
| 3/4 | security: filesystem capabilities refactor kernel codekernel/ | +221 | 2 replies | |
| 4/4 | security: filesystem capabilities no longer experimentalsecurity/ | +2 | 1 reply |
Reviews trailers per patch
All 4 patches have a Reviewed-by or Acked-by.
| Patch | Serge Hallyn | David Howells |
|---|---|---|
| 1/4 | A-b | A-b |
| 2/4 | A-b | A-b |
| 3/4 | A-b | |
| 4/4 | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH 0/4]: security: filesystem capabilities (was Re: [PATCH] capabilities: refactor kernel code + bugfix)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Andrew,
Configuring filesystem capabilities is still tagged experimental, and the effect of the "security fix" part of this change is conditional on filesystem capabilities being configured. This late in the rc cycle, I'm not convinced that the risk of this bugfix isn't greater than the benefit.
If you disagree, there is another "security" problem with filesystem capabilities and strace, and I've been exploring the fix. This is also the last fix I think we need before we can remove the experimental attribute on filesystem capabilities.
As such, I'll follow this up with four patches. The first two are bugfixes (affecting kernels configured with filesystem support); the third is the refactoring; and the fourth removes the experimental tag on filesystem capability support.
Cheers
Andrew
Andrew Morton wrote:
| On Fri, 20 Jun 2008 08:38:19 -0700 | "Andrew G. Morgan" <[email protected]> wrote: | |> From 8a2bffcb5363295ea43ef42c84c121a8e8c7ffa0 Mon Sep 17 00:00:00 2001 |> From: Andrew G. Morgan <[email protected]> |> Date: Fri, 20 Jun 2008 08:16:06 -0700 |> Subject: [PATCH] Refactor filesystem capability support in main kernel. |> [...] | This is one helluva large (security!) patch for so late in -rc. | | Could we please split out the bugfix for 2.6.26 (is it needed in 2.6.25 | too?) and hold the refactoring back for 2.6.27?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQFIY1dr+bHCR3gb8jsRAsUDAJsGSGgj7TVq29CoTIOff3p1xkHYYwCfWFQ9 Qm4ZQthlkNikLDoMuhalBx4=
=8NT4
-----END PGP SIGNATURE-----