Messages in this thread | | | From | "Mike Wray" <> | Subject | Re: [PATCH] remove sys_security | Date | Mon, 21 Oct 2002 17:44:15 +0100 |
| |
From: Christoph Hellwig <hch@infradead.org> Sent: 21 October 2002 15:09 > On Mon, Oct 21, 2002 at 02:54:33PM +0100, Mike Wray wrote: > > I'm not sure the case for removal has been made. Some potential problems > > with the LSM security syscall have been pointed out. Isn't it better to > > consider > > fixes instead of ditching the syscall? > > The conceptual wrong design was pointed out, yes. It's not fixable > without rplacing it with a proper design of the security module entry > points. >
I'm not sure what was conceptually wrong. There are other multiplexing syscalls in the kernel - so the concept of multiplexing cannot be wrong? Or is setsockopt broken too?
If it's just the particular signature used right now that's the problem, then that's easily fixed.
For example, what would be wrong in making the security syscall follow the get/set sockopt approach?
> > Won't the absence of the syscall just result > > in even worse code being used? Presumably SELinux will have to implement > > the syscall functionality some other way. > > Unlike this hook there is a chance we can review their new creations when > they ask for inclusion.
Netfilter provides nf_register_sockopt() to allow open-ended registration of socket-opt handling by a module - without any review. So do many other kernel interfaces.
Mike
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |