Messages in this thread |  | | Subject | Re: [PATCH 12/19] CacheFiles: Permit a process's create SID to be overridden | From | Stephen Smalley <> | Date | Mon, 20 Nov 2006 13:41:13 -0500 |
| |
On Tue, 2006-11-14 at 16:19 -0500, James Morris wrote: > On Tue, 14 Nov 2006, David Howells wrote: > > > +static u32 selinux_set_fscreate_secid(u32 secid) > > +{ > > + struct task_security_struct *tsec = current->security; > > + u32 oldsid = tsec->create_sid; > > + > > + tsec->create_sid = secid; > > + return oldsid; > > +} > > The ability to set this needs to be mediated via MAC policy. > > See selinux_setprocattr()
That's different - selinux_set_fscreate_secid() is for internal use by a kernel module that wishes to temporarily assume a particular fscreate SID, whereas selinux_setprocattr() handles userspace writes to /proc/self/attr nodes. Imposing a permission check here makes no sense.
-- Stephen Smalley National Security Agency
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |