Subject: Re: Getting rid of /dev/veriexec
To: Elad Efrat <elad@NetBSD.org>
From: Nathan J. Williams <nathanw@wasabisystems.com>
List: tech-kern
Date: 12/02/2005 09:56:29
Elad Efrat <elad@NetBSD.org> writes:
> Nathan J. Williams wrote:
>
> > The same reason; I don't like sysctl being used for things other than
> > individual knobs. I'm OK with sysctl(8) as a UI, but I don't think
> > that sysctl(3) does much but duplicate other infrastructure - namely,
> > the filesystem.
>
> I understand your point, though let me point out some things:
>
> 1. This is *your* view of sysctl(3);
Yes. Why is it less important than yours?
> 2. Removing a sgid kmem binary *NOW* is better than "coming up with a
> better solution in the future";
This is a similarly religious position.
> 3. How many locally exploitable root holes procfs (on BSD/Linux) and/or
> kernfs have? how many our sysctl(9) have?
I don't know. How many are you planning to introduce? Complicated
interfaces are exactly where trouble occurs, and you're about to add a
complicated interface into sysctl().
- Nathan