Messages in this thread | | | Date | Thu, 9 Sep 2004 10:22:00 -0700 | From | William Lee Irwin III <> | Subject | Re: [1/1][PATCH] nproc v2: netlink access to /proc information |
| |
On Wed, 2004-09-08 at 14:41, Roger Luethi wrote: >> A few notes: >> - Access control can be implemented easily. Right now it would be bloat, >> though -- the vast majority of fields in /proc are world-readable >> (/proc/pid/environ being the notable exception).
On Thu, Sep 09, 2004 at 07:53:31AM -0400, Stephen Smalley wrote: > They aren't world readable when using a security module like SELinux; > they are then typically only accessible by processes in the same > security domain, aside from processes in privileged domains. > security_task_to_inode() hook sets the security attributes on the > /proc/pid inodes based on their security context, and then > security_inode_permission() hook controls access to them. So you need > at least comparable controls.
Can you make a more specific suggestion regarding the controls to use? It's a bit awkward for those highly unfamiliar with the subsystem to invent new methods for the security layer independently, so it's likely best some guidance (e.g. function prototype) be given.
-- wli - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |