Messages in this thread | | | Date | Thu, 4 Nov 2004 16:56:50 -0800 | From | Chris Wright <> | Subject | Re: [RFC] [PATCH] [6/6] LSM Stacking: temporary setprocattr hack |
| |
* Serge E. Hallyn (serue@us.ibm.com) wrote: > Quoting Chris Wright (chrisw@osdl.org): > > * Serge Hallyn (serue@us.ibm.com) wrote: > > > Stacker assumes that data written to /proc/<pid>/attr/* is of the > > > form: > > > > > > module_name: data > > > > This breaks current tools where fields are space-delimited. procps does > > filtering that way, and I believe libselinux does as well. > > Oh, are you talking about the output of getprocattr? Perhaps the output > should (temporarily) be default list the selinux info on the first line, > without a "selinux: " prepended, and list any other modules after?
Ah, yeah, getprocattr, not the stacker setprocattr, sorry. For quick testing, something like that is sufficient. But for longterm it's got to be less hackish.
> You mentioned a common LSM sysfs framework. Does it offer support for > both per-module and per-pid-per-module files? If so, then I suppose it > would be fair to force LSMs to use those, and reserve the existing > {gs}etprocattr files for selinux use (or nuke them).
Right now it's just per-module files. The latter adds extra expense per fork that would be nice to avoid. Could be a sort of transaction file, write the pid, get back the assoiciated data, and thus be static with the directory.
thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |