Messages in this thread | | | Date | Fri, 3 Oct 2008 08:09:37 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [TOMOYO #9 (2.6.27-rc7-mm1) 1/6] LSM adapter functions. |
| |
Quoting Kentaro Takeda (takedakn@nttdata.co.jp): > Serge E. Hallyn wrote: > > Just keep your own hash table. > I see, then we want one more LSM hook for clearing the hash table > after returing from vfs_*(). > > foo() { > error = security_path_foo(); /* save result in the hash table */ > error = vfs_foo(); /* fetch from the hash table in security_inode_*() */ > security_path_clear(); /* clear the hash table */ > } > > Is it acceptable?
Why can't you just clear the value during security_inode_foo()?
Note I'm seeing this as a way for Tomoyo to temporarily (maybe) work around the mis-placement of the security_path_foo() hooks. I don't want to add security_path_clear() hooks to "legitimize" the workaround. I'd rather Tomoyo and Apparmor folks keep looking for a better way to get real DAC-before-MAC.
> Regards, > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html
| |