lkml.org 
[lkml]   [2002]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] remove sys_security
Date

From: Christoph Hellwig <hch@infradead.org>
Sent: 21 October 2002 15:09
> On Mon, Oct 21, 2002 at 02:54:33PM +0100, Mike Wray wrote:
> > I'm not sure the case for removal has been made. Some potential problems
> > with the LSM security syscall have been pointed out. Isn't it better to
> > consider
> > fixes instead of ditching the syscall?
>
> The conceptual wrong design was pointed out, yes. It's not fixable
> without rplacing it with a proper design of the security module entry
> points.
>

I'm not sure what was conceptually wrong. There are other multiplexing
syscalls
in the kernel - so the concept of multiplexing cannot be wrong?
Or is setsockopt broken too?

If it's just the particular signature used
right now that's the problem, then that's easily fixed.

For example, what would be wrong in making the security syscall follow the
get/set sockopt approach?

> > Won't the absence of the syscall just result
> > in even worse code being used? Presumably SELinux will have to implement
> > the syscall functionality some other way.
>
> Unlike this hook there is a chance we can review their new creations when
> they ask for inclusion.

Netfilter provides nf_register_sockopt() to allow open-ended registration
of socket-opt handling by a module - without any review. So do many other
kernel interfaces.

Mike

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:30    [W:0.056 / U:1.840 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site