On Fri, 17 Dec 2004, Bill Davidsen wrote:
James Morris wrote:
On Fri, 17 Dec 2004, Patrick McHardy wrote:
James Morris wrote:
This at least needs CAP_NET_ADMIN.
It is already checked in do_ip6t_set_ctl(). Otherwise anyone could
replace iptables rules :)
That's what I meant, you need the capability to do anything bad :-)
Are you saying that processes with capability don't make mistakes? This isn't
a bug related to untrusted users doing privileged operations, it's a case of
using unchecked user data.
But isn't there always the possibility of "unchecked user data"?
I can, as root, do `cp /dev/zero /dev/mem` and have the most
spectacular crask you've evet seen. I can even make my file-
systems unrecoverable.
Cheers,
Dick Johnson
Penguin : Linux version 2.6.9 on an i686 machine (5537.79 BogoMips).
Notice : All mail here is now cached for review by Dictator Bush.
98.36% of all statistics are fiction.
|