From: Peter Eisentraut <peter_e@gmx.net>
To: Stephen Frost <sfrost@snowman.net>
Cc: Adam Brightwell <adam.brightwell@crunchydatasolutions.com>
Cc: Noah Misch <noah@leadboat.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: CATUPDATE confusion?
Date: Tue, 03 Mar 2015 16:32:27 -0500
Message-ID: <54F6286B.90802@gmx.net> (raw)
In-Reply-To: <20150228233245.GO29780@tamriel.snowman.net>
References: <28382.1419703324@sss.pgh.pa.us>
<20141227231829.GX3062@tamriel.snowman.net>
<1952.1419722762@sss.pgh.pa.us>
<20141227233150.GA2046947@tornado.leadboat.com>
<CAKRt6CTrOf6w5sE5GDRQAJ+JQrfK4h8VM=jVCtiGC+mdFsmXGg@mail.gmail.com>
<54E65000.8030304@gmx.net>
<20150225203955.GY29780@tamriel.snowman.net>
<54EE8C6E.8090506@gmx.net>
<20150226030541.GG29780@tamriel.snowman.net>
<54F2376E.9080501@gmx.net>
<20150228233245.GO29780@tamriel.snowman.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On 2/28/15 6:32 PM, Stephen Frost wrote:
> This isn't really /etc/shadow though, this is more like direct access to
> the filesystem through the device node- and you'll note that Linux
> certainly has got an independent set of permissions for that called the
> capabilities system. That's because messing with those pieces can crash
> the kernel. You're not going to crash the kernel if you goof up
> /etc/shadow.
I think this characterization is incorrect. The Linux capability system
does not exist because the actions are scary or can crash the kernel.
Capabilities exist because they are not attached to file system objects
and can therefore not be represented using the usual permission system.
Note that one can write directly to raw devices or the kernel memory
through various /dev and /proc files. No "capability" protects against
that. It's only the file permissions, possibly in combination with
mount options.
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter_e@gmx.net, sfrost@snowman.net, adam.brightwell@crunchydatasolutions.com, noah@leadboat.com, tgl@sss.pgh.pa.us
Subject: Re: CATUPDATE confusion?
In-Reply-To: <54F6286B.90802@gmx.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox