lkml.org 
[lkml]   [2007]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [TOMOYO 15/15] LSM expansion for TOMOYO Linux.
    Date
    On Tuesday, August 28 2007 6:39:13 am Tetsuo Handa wrote:
    > Hello.

    Hello.

    > Paul Moore wrote:
    > > > * post_recv_datagram is added in skb_recv_datagram.
    > >
    > > Can you explain to me why this is not possible using the existing
    > > security_socket_sock_rcv_skb() LSM hook?
    >
    > socket_sock_rcv_skb() is a hook for enqueue time.
    > I want a hook for dequeue time, because what TOMOYO Linux is doing is
    > not "whether a socket created by foo is permitted to pick up
    > an incoming packet from specific address/port"
    > but "whether bar is permitted to pick up
    > an incoming packet from specific address/port".
    > At the time of enqueue, I can't know who will pick up that packet.
    >
    > Same reason for socket_post_accept(). What TOMOYO Linux is doing is
    > not "whether a socket created by foo is permitted to accept
    > a connection request from specific address/port"
    > but "whether bar is permitted to accept
    > a connection request from specific address/port".
    > At the time of enqueue, I can't know who will pick up that request.

    I apologize for not recognizing your approach from our earlier discussion on
    the LSM mailing list in July. Unfortunately, I have the same objections to
    these changes that I did back then and from what I can recall of the
    discussion the rest of the kernel networking community agreed that these
    changes are not the preferred way of solving this problem. We offered
    suggestions on how to accomplish your goals in a way that would be acceptable
    upstream and I would encourage you to investigate those options further.

    --
    paul moore
    linux security @ hp
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-08-28 15:25    [W:0.021 / U:22.724 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site