Messages in this thread | | | Date | Wed, 29 Mar 2006 15:13:15 -0800 | From | Chris Wright <> | Subject | Re: [RFC] Virtualization steps |
| |
* Sam Vilain (sam@vilain.net) wrote: > AIUI inode_ops are not globals, they are per FS.
Heh, yes really bad example.
> That to me reads as: > > "To avoid having to consider making security_ops non-global we will > force security modules to be container aware".
Not my intention. Rather, I think from a security standpoint there's sanity in controlling things with a single policy. I'm thinking of containers as a simple and logical extension of roles. Point being, the per-object security label can easily include notion of container.
> It also means you could not mix security modules that affect the same > operation different containers on a system. Personally I don't care, I > don't use them. But perhaps this inflexibility will bring problems later > for some.
No issue with addressing these issues as they come.
thanks, -chris - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |