[lkml]   [2004]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC] [PATCH] [6/6] LSM Stacking: temporary setprocattr hack
* Serge E. Hallyn ( wrote:
> Quoting Chris Wright (
> > * Serge Hallyn ( wrote:
> > > Stacker assumes that data written to /proc/<pid>/attr/* is of the
> > > form:
> > >
> > > module_name: data
> >
> > This breaks current tools where fields are space-delimited. procps does
> > filtering that way, and I believe libselinux does as well.
> Oh, are you talking about the output of getprocattr? Perhaps the output
> should (temporarily) be default list the selinux info on the first line,
> without a "selinux: " prepended, and list any other modules after?

Ah, yeah, getprocattr, not the stacker setprocattr, sorry. For quick
testing, something like that is sufficient. But for longterm it's got
to be less hackish.

> You mentioned a common LSM sysfs framework. Does it offer support for
> both per-module and per-pid-per-module files? If so, then I suppose it
> would be fair to force LSMs to use those, and reserve the existing
> {gs}etprocattr files for selinux use (or nuke them).

Right now it's just per-module files. The latter adds extra expense per
fork that would be nice to avoid. Could be a sort of transaction file,
write the pid, get back the assoiciated data, and thus be static with
the directory.

Linux Security Modules
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:07    [W:0.057 / U:7.408 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site