Messages in this thread | ![/](/images/icornerl.gif) | | From | Andi Kleen <> | Subject | Re: Some Concrete AppArmor Questions - was Re: [RFC][PATCH 0/11] security: AppArmor - Overview | Date | Thu, 27 Apr 2006 13:05:59 +0200 |
| |
On Thursday 27 April 2006 13:02, Christoph Hellwig wrote: > On Thu, Apr 27, 2006 at 08:15:30AM +1000, Neil Brown wrote: > > 3/ Is AppArmour's approach of using d_path to get a filename from a > > dentry valid and acceptable? > > Clear no, and that should have been obvious to the aa people from the > beginning. To make a path-based approach actually work as designed you > need to hook up higher, where the real path is available.
What do you mean with real path? Even in open the path can be quite weird ("dir1/../dir2/../dir3/..." etc.)
I suspect it will always need to work with sanitized paths.
Starting from the dentry for that is a quite reasonable, although d_path indeed seems quite inefficient without any caching mechanism.
-Andi - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| ![\](/images/icornerr.gif) |