[lkml]   [2003]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] Extended Attributes for Security Modules against 2.5.68
    On Thu, 2003-04-24 at 14:36, Chris Wright wrote:
    > Or perhaps introducing some of the CAP_MAC_* bits.

    I don't think that would help. As I mentioned during the earlier
    discussion with Andreas, you want to be able to allow the security
    module to call the inode getxattr and setxattr operations without
    restriction for internal management of the security labels, while
    applying access controls to user processes invoking the [gs]etxattr
    system calls. Hence, you don't want the permission check implemented in
    the handler; it is better to handle the checking entirely via the LSM
    hooks in the [gs]etxattr calls and allow unrestricted internal use of
    the inode [gs]etxattr operations by the module. Capability checks are
    also too coarse-grained; you want to be able to perform a permission
    check based on the process and the inode attributes, not just a
    process-based check.

    If the intent of the trusted namespace is for attributes that can be
    managed by superuser processes (this is my impression), then I think it
    would be better to create a separate namespace and handler for security
    modules for clarity. Or at least for MAC modules.

    Stephen Smalley <>
    National Security Agency

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:34    [W:0.022 / U:4.040 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site