Messages in this thread | | | Date | Tue, 6 Jan 2009 09:58:29 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH] Add in_execve flag into task_struct. |
| |
Quoting Tetsuo Handa (penguin-kernel@i-love.sakura.ne.jp): > Serge, > > James is now reviewing TOMOYO Linux patch and he is caring about > your comment below. > > Serge E. Hallyn wrote: > > I don't like the 'in_exec' bit in the task_struct, but adding LSM hooks > > to let just TOMOYO mark whether you're in exec seems even uglier. > > Let me (once again) ask your comment on 'in_exec' approach > originally suggested by David Howells ( http://lkml.org/lkml/2008/10/2/127 ).
I still don't like it. Now I gather the reason for this is that you want to allow a less trusted domain to execute a file (in a new domain) without giving it the right to read it? I'd be interested in hearing whether others think that's a worthy goal.
-serge
| |