Messages in this thread | | | Date | Fri, 29 Feb 2008 13:15:16 +1100 (EST) | From | James Morris <> | Subject | Re: [PATCH 01/11] Security: Add hook to get full maclabel xattr name |
| |
On Thu, 28 Feb 2008, Casey Schaufler wrote:
> Easier may be pragmatic, but that does not make it right. > I suggest, that in my opinion (there, is that sufficiently > non-confrontational?) that Linux and the LSM are much better > served by a general xattr protocol than by adding a single > reccommended attribute.
An xattr protocol is overkill for conveying a MAC label over the network, and would still not provide the required semantics.
Please see prior discussion on this e.g.
http://marc.info/?l=linux-kernel&m=120424789929258&w=2
Note that RAs are already used to convey ACLs and all other system-managed metatdata. i.e. an extensible, appropriate infrastructure already exists in the NFSv4 protocol, and has been used successfully for similar purposes. We do not need to add a new, generalized protocol to NFSv4 for this, especially one which does not meet the requirements.
- James -- James Morris <jmorris@namei.org>
| |