lkml.org 
[lkml]   [2007]   [Dec]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 08/28] SECURITY: Allow kernel services to override LSM settings for task actions [try #2]
Date
Casey Schaufler <casey@schaufler-ca.com> wrote:

> It would seem to me that security_secctx_to_secid() ought to suffice if the
> application code was written correctly.

That's not quite sufficient as there still needs to be a verification step to
make sure the caller is allowed to do this.

> Be aware that factors outside the LSM may be important, too. As Stephen
> points out elsewhere, Smack will require you have particular capabilities
> (CAP_MAC_OVERRIDE, CAP_MAC_ADMIN) while a DAC LSM may require
> CAP_DAC_OVERRIDE.

For what?

David


\
 
 \ /
  Last update: 2007-12-12 23:57    [W:0.151 / U:0.688 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site