| Date | Thu, 12 Apr 2007 11:10:21 +0100 | From | Alan Cox <> | Subject | Re: [AppArmor 03/41] Remove redundant check from proc_sys_setattr() |
| |
On Thu, 12 Apr 2007 02:08:12 -0700 jjohansen@suse.de wrote:
> notify_change() already calls security_inode_setattr() before > calling iop->setattr.
This is a behaviour change on all of these and limits some behaviour of existing established security modules
When inode_change_ok is called it has side effects. This includes clearing the SGID bit on attribute changes caused by chmod. If you make this change the results of some rulesets may be different before or after the change is made.
I'm not saying the change is wrong but it does change behaviour so that needs looking at closely (ditto all other attribute twiddles)
Alan
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|