Re: Bug#889098: enforce fs.protected_hardlinks in sysctl.d by default

2018-02-03 Thread Antoine Beaupré
On 2018-02-03 10:54:18, Salvatore Bonaccorso wrote: > Hi > > On Fri, Feb 02, 2018 at 09:25:31PM +0100, Moritz Mühlenhoff wrote: >> Antoine Beaupré wrote: >> > There are, however, people *not* running Debian-built kernels, and >> > sometimes for good reasons. This is a configuration that we should >

Re: Bug#889098: enforce fs.protected_hardlinks in sysctl.d by default

2018-02-03 Thread Ben Hutchings
On Sat, 2018-02-03 at 00:45 +, Craig Small wrote: > Hi Antoine (and kernel and security teams), > Thanks for giving me the background as it's a kernel vulnerability not a > Procps one I wasn't aware of it. It's not a kernel vulnerability, but a class of application vulnerabilities that the k

Re: Bug#889098: enforce fs.protected_hardlinks in sysctl.d by default

2018-02-03 Thread Salvatore Bonaccorso
Hi On Fri, Feb 02, 2018 at 09:25:31PM +0100, Moritz Mühlenhoff wrote: > Antoine Beaupré wrote: > > There are, however, people *not* running Debian-built kernels, and > > sometimes for good reasons. This is a configuration that we should > > still support. > > Is it supported, but it's also clearl

Re: Bug#889098: enforce fs.protected_hardlinks in sysctl.d by default

2018-02-02 Thread Craig Small
Hi Antoine (and kernel and security teams), Thanks for giving me the background as it's a kernel vulnerability not a Procps one I wasn't aware of it. The change to Procps is pretty simple but given that you need to be running a non Debian kernel without this parameter what's groups' opinion of t