lkml.org 
[lkml]   [2004]   [Oct]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] Realtime LSM
From
Date
Chris Wright <chrisw@osdl.org> writes:

> * Jack O'Quin (joq@io.com) wrote:
> > Chris Wright <chrisw@osdl.org> writes:
> > > use in_group_p
> >
> > I looked at that, it wasn't clear to me whether to use in_group_p() or
> > in_egroup_p(). How do you choose?
>
> For most cases they'll be identical. The difference is whether you're
> comparing the fsgid or the egid. The former is what's used for file
> access, the latter might make more sense in your case. However, in
> 99.9% of the cases you care about fsgid == egid, so it's a wash. So,
> in_egroup_p matches a bit better. Relative to the other patches...

Thanks. I was familiar with gid, and egid from other Unix kernels,
but fsgid is new to me.

In what cases does it *differ* from the effective group ID?

> --- security/realtime.c~rm_CONFIG_SECURITY 2004-10-08 16:16:35.000000000 -0700
> +++ security/realtime.c 2004-10-08 21:06:28.020084984 -0700
> @@ -66,7 +66,7 @@
> if ((gid == e_gid) || (gid == current->gid))
> return 1;
>
> - return in_group_p(gid);
> + return in_egroup_p(gid);
> }
>
> static int realtime_bprm_set_security(struct linux_binprm *bprm)

This adds a test against current->egid in addition to the explicit
check of current->gid. I don't see any problem with that. AFAICT,
the current->gid check is still useful.
--
joq
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:06    [W:0.770 / U:0.556 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site