lkml.org 
[lkml]   [2018]   [Jul]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 08/32] smack: Implement filesystem context security hooks [ver #9]
    Date
    Casey Schaufler <casey@schaufler-ca.com> wrote:

    > > Implement filesystem context security hooks for the smack LSM.
    > >
    > > Question: Should the ->fs_context_parse_source() hook be implemented to
    > > check the labels on any source devices specified?
    >
    > Checking the label on a block device when doing a mount
    > is just going to end in tears. If you're remounting from
    > an already mounted filesystem it might make sense to check
    > that the new mount doesn't provide greater access than the
    > existing mount. If the original mount has smackfsdefault="_"
    > I could see prohibiting the additional mount having
    > smackfsdefault="*" on a filesystem that doesn't support
    > xattrs. But that requires that a (hopefully) privileged
    > process be involved, and we expect them to have a clue.
    > So no, I don't see it necessary.

    I think I may have meant the device file rather than the actual device
    content.

    David

    \
     
     \ /
      Last update: 2018-07-11 01:20    [W:5.566 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site