Messages in this thread | | | Date | Thu, 23 Oct 2008 13:57:34 -0400 | From | Shaya Potter <> | Subject | Re: [TOMOYO #11 (linux-next) 01/11] Introduce new LSM hooks where vfsmount is available. |
| |
Shaya Potter wrote: > crispin@crispincowan.com wrote: >> Quoting Shaya Potter <spotter@cs.columbia.edu>: >>> I know I'm late to the game in this, but as I recently asked about this >>> and didn't get an answer, I'll re-ask my approach. >>> >>> Why can't you do this >>> >>> in lookup() >>> >>> - resolve rules (not for single process, but for all processes) for >>> said path and tag dentry (seem to already have a hook) >>> >>> in permission() >> >> Because it doesn't work >> http://kerneltrap.org/mailarchive/linux-fsdevel/2007/6/8/319446 >> >> Quick summary: The difference between the pathname model and the label >> model is dynamism. The accessi really is determined by the pathname to >> the file that you used to access the file. If you try to compute >> access based on attributes tagged onto the file, then you have to >> re-compute those attributes every time someone renames a file. > > ok. simple question then so why not just recompute them every every > rename? are rename's that common relative to all other file operations > where we care?
just want to followup as didn't get a response. If the problem is rename(), what's the problem with dropping the label on rename() to force a reevaluation on the next pass through the lookup() code.
| |