lkml.org 
[lkml]   [2007]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 08/28] SECURITY: Allow kernel services to override LSM settings for task actions [try #2]
Date
Stephen Smalley <sds@tycho.nsa.gov> wrote:

> It is just a way of carving up the permission space, typically based on
> object type, but it can essentially be arbitrary. The check in this
> case seems specific to cachefiles since it is controlling an operation
> on the /dev/cachefiles interface that only applies to cachefiles
> internal operations, so making a cachefiles class seems reasonable.

Can you specify what sort of permissions you're thinking of providing for
tasks to operate on this class? Can an object of this class 'operate' on
other objects, or can only process-class objects do that?

How does an object of this class acquire a label? What is an object of this
class? Is it a "cache"? Or were you thinking of a "module"?

David


\
 
 \ /
  Last update: 2007-12-13 16:39    [W:0.107 / U:0.180 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site