Messages in this thread | | | Date | Wed, 19 Apr 2006 09:06:27 -0700 | From | Greg KH <> | Subject | Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks |
| |
On Wed, Apr 19, 2006 at 12:02:32PM -0400, Stephen Smalley wrote: > On Wed, 2006-04-19 at 08:44 -0700, Greg KH wrote: > > On Wed, Apr 19, 2006 at 08:55:56AM -0400, Yuichi Nakamura wrote: > > > However, path-name based configuration can not be achieved on SELinux in > > > following cases. > > > 1) Files on file system that does not support xattr(such as sysfs) > > > SELinux policy editor handles all files as same on such file systems. > > > > Hm, I've thought about this in the past and wonder if we should add > > xattr support to sysfs. Would it be useful for things like SELinux? > > The files would not be created with any xattrs, but would be able to > > have them once they are set. Would that be good enough? > > The generic security xattr fallback behavior in the VFS already provides > us with most of what we need there. The only thing missing is a way to > preserve the attributes when inodes are evicted and later re-created > from sysfs_dirent.
Yeah, without that, it's probably pretty useless :) Take a look at the patch that added support for owner/mode settings, it shouldn't be that hard to also add xattr support there.
> One of our people was experimenting with a patch to save and restore > that information, but we are waiting for some of the audit work to > finalize as that exports some interfaces from SELinux to the rest of > the kernel that we need.
That sounds fine, thanks for letting me know.
greg k-h - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |