Comment 23 for bug 634183

I made no claim that POSIX ACL's have any security risk.

What I said is

1) there is other data attached to an inode beyond setuid/setgid/capabilities
that also will track with hardlink attacks. And its not just privilege escalation
that can lead to attack vectors, all of ACL's/capabilities/setuid needs to be considered.

2) the solution should not be attempted in RPM, nor with endless
CVE's. RPM (or any application) cannot solve hardlink attacks.

3) There are other and more serious issues in RPM that are in
need of a CVE.

I'm not the moron who decided that a CVE was needed because RPM
did not clear POSIX ACL's

And I'm also not the moron who claimed that I dropped a security related
patch while checking into RPM CVS back in 2005.