Messages in this thread | | | Subject | Re: A basic question about the security_* hooks | From | Tetsuo Handa <> | Date | Fri, 25 Dec 2009 06:55:08 +0900 |
| |
Eric W. Biederman wrote: > My immediate impression is that the big limitation today is the > sharing of the void * security data members of strucutres.
I think the time to change "void * security" is approaching.
What about allocating dedicated "void *" for each in-tree security modules and let proposed security modules use "void * security" so that proposed security modules can be evaluated without allocating dedicated "void *", something like
struct foo { ... #ifdef CONFIG_SECURITY_SELINUX void *selinux; #endif #ifdef CONFIG_SECURITY_SMACK void *smack; #endif #ifdef CONFIG_SECURITY_PROPOSED void *security #endif } struct bar { ... #ifdef CONFIG_SECURITY_SELINUX void *selinux; #endif #ifdef CONFIG_SECURITY_PROPOSED void *security #endif }
?
Regarding TOMOYO, "void * security" automatically added to many structure is nothing but waste of memory because TOMOYO don't need "void * security" except "struct task_struct".
| |