Messages in this thread | | | Subject | Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks | From | Stephen Smalley <> | Date | Wed, 19 Apr 2006 12:02:32 -0400 |
| |
On Wed, 2006-04-19 at 08:44 -0700, Greg KH wrote: > On Wed, Apr 19, 2006 at 08:55:56AM -0400, Yuichi Nakamura wrote: > > However, path-name based configuration can not be achieved on SELinux in > > following cases. > > 1) Files on file system that does not support xattr(such as sysfs) > > SELinux policy editor handles all files as same on such file systems. > > Hm, I've thought about this in the past and wonder if we should add > xattr support to sysfs. Would it be useful for things like SELinux? > The files would not be created with any xattrs, but would be able to > have them once they are set. Would that be good enough?
The generic security xattr fallback behavior in the VFS already provides us with most of what we need there. The only thing missing is a way to preserve the attributes when inodes are evicted and later re-created from sysfs_dirent. One of our people was experimenting with a patch to save and restore that information, but we are waiting for some of the audit work to finalize as that exports some interfaces from SELinux to the rest of the kernel that we need.
-- Stephen Smalley National Security Agency
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |