lkml.org 
[lkml]   [2006]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks
On Wed, Apr 19, 2006 at 12:02:32PM -0400, Stephen Smalley wrote:
> On Wed, 2006-04-19 at 08:44 -0700, Greg KH wrote:
> > On Wed, Apr 19, 2006 at 08:55:56AM -0400, Yuichi Nakamura wrote:
> > > However, path-name based configuration can not be achieved on SELinux in
> > > following cases.
> > > 1) Files on file system that does not support xattr(such as sysfs)
> > > SELinux policy editor handles all files as same on such file systems.
> >
> > Hm, I've thought about this in the past and wonder if we should add
> > xattr support to sysfs. Would it be useful for things like SELinux?
> > The files would not be created with any xattrs, but would be able to
> > have them once they are set. Would that be good enough?
>
> The generic security xattr fallback behavior in the VFS already provides
> us with most of what we need there. The only thing missing is a way to
> preserve the attributes when inodes are evicted and later re-created
> from sysfs_dirent.

Yeah, without that, it's probably pretty useless :)
Take a look at the patch that added support for owner/mode settings, it
shouldn't be that hard to also add xattr support there.

> One of our people was experimenting with a patch to save and restore
> that information, but we are waiting for some of the audit work to
> finalize as that exports some interfaces from SELinux to the rest of
> the kernel that we need.

That sounds fine, thanks for letting me know.

greg k-h
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-04-19 18:13    [W:0.163 / U:0.460 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site