Bug 922030 - Turn on symlink protections in sysctl
Summary: Turn on symlink protections in sysctl
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: initscripts
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Bill Nottingham
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-03-15 12:35 UTC by Daniel Walsh
Modified: 2014-03-17 03:33 UTC (History)
8 users (show)

Fixed In Version: initscripts-9.45-1.fc19
Clone Of:
Environment:
Last Closed: 2013-03-15 14:41:19 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Do what dan says. (664 bytes, patch)
2013-03-15 13:03 UTC, Josh Boyer
no flags Details | Diff

Description Daniel Walsh 2013-03-15 12:35:21 UTC
Description of problem:


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Daniel Walsh 2013-03-15 13:00:02 UTC
Could you add these lines

fs.protected_hardlinks = 1
fs.protected_symlinks = 1

to 

/usr/lib/sysctl.d/00-system.conf

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=800179c9b8a1e796e441674776d11cd4c05d61d7

Explains these restrictions.

Comment 2 Josh Boyer 2013-03-15 13:03:41 UTC
Created attachment 710662 [details]
Do what dan says.

Now with patch

Comment 3 Lukáš Nykrýn 2013-03-15 13:11:28 UTC
Applied in upstream repository. Thanks.

Comment 4 Kay Sievers 2013-03-15 14:58:58 UTC
Let's move that setting and the entire file to upstream systemd, we should
make that general Linux default and not only put it into a fedora-only
package.

Comment 5 Bill Nottingham 2013-03-15 19:10:34 UTC
Hm.

Some of those settings I could see being the general Linux default, but at least in downstream distributions we do things like changing the defaults of shmmax/shmall.


Note You need to log in before you can comment on or make changes to this bug.