lkml.org 
[lkml]   [2002]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH] remove sys_security
    Date
    On Thu, 17 Oct 2002 23:49, Alexander Viro wrote:
    > On Thu, 17 Oct 2002, Russell Coker wrote:
    > > > What specific information differs per-operation, such that security
    > > > identifiers cannot be stored internally inside a file handle?
    > >
    > > My previous message obviously wasn't clear enough.
    > >
    > > When you want to read or set the SID of a file handle then you need to
    > > pass in a SID pointer or a SID.
    >
    > So fscking what? _Nothing_ of the above warrants a new syscall. There
    > are struct file * attributes and there are descriptor attributes.
    > Rather than excreting a new syscall you could look what already exists
    > in the API.

    OK, how do you go about supplying extra data to a file open than to modify the
    open system call?

    If for example I want to create a file of context
    "system_u:object_r:fingerd_log_t" under /var/log (instead of taking the
    context from that of the /var/log directory "system_u:object_r:var_log_t")
    then how would I go about doing it other than through a modified open system
    call?

    When are extended attributes going to be in Ext2/3? This issue could be
    solved through them, but not in any other way AFAIK.

    > Frankly, SELinux has some interesting ideas, but interfaces are appalling.
    > Either they've never cared about it, or they have no taste (or have, er,
    > overriding manag^Wissues actively hostile to any taste). Take your pick.
    >
    > And don't get me started on access to file by inumber and other beauties
    > in that excuse of an API. It wasn't designed. It happened. As in, "it
    > happens".

    ichsid() was created to allow relabeling of the mount points of mounted file
    systems.

    When you install SE Linux you need to have the mount points labelled
    appropriately. The default file_t is usually OK, however there is the issue
    of re-installing SE Linux on a machine that previously had it, and as the SE
    Linux type labels are not integrated into the file system (need extended
    attributes) the type database could be out of sync with the file system. Of
    course most mount points can be relabelled in single user mode after
    umounting the file systems - except /dev on a devfs system...

    Admittedly ichsid() is pretty ugly even when you consider the ugly problem
    it's trying to solve.

    What are the "other beauties" you refer to?

    --
    http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
    http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
    http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
    http://www.coker.com.au/~russell/ My home page

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:30    [W:2.125 / U:2.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site