Is there a reason we do not turn on the file system hardlink/symlink protection in Rawhide?

[Reindl Harald]

Am 24.03.2013 04:08, schrieb Kevin Kofler:
> Miloslav Trmač wrote:
>> BTW determining this accurately should be fairly doable[1].  Just look
>> for symlink() and link() calls (and recursively through wrapper APIs /
>> language bindings).  These syscalls are fairly rare.
> 
> That checks for PROGRAMS which run into this. It catches neither admin's 
> custom scripts nor ln commands run directly by the users. Who knows on how 
> many machines manually created symlinks point to inodes owned by different 
> users?

maybe you guys should read what the protection does
how many directories except /tmp are world-writeable and have STICKY bit?

fs.protected_symlink
symlinks to only be followed when outside a sticky world-writable directory

fs.protected_hardlinks
blocks hardlinks to other people's WORLD-READABLE files if you can't write to them

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 263 bytes
Desc: OpenPGP digital signature
URL: <http://lists.fedoraproject.org/pipermail/devel/attachments/20130324/562aea49/attachment.sig>