Messages in this thread | | | Date | Wed, 14 May 2008 09:58:42 -0700 | From | Chris Wright <> | Subject | Re: [RFC][PATCH] security: split ptrace checking in proc |
| |
* Stephen Smalley (sds@tycho.nsa.gov) wrote: > What do you mean by "generic" in the above? Just the fact that there > wouldn't be any distinction between such access and access to a > descriptor received explicitly via local IPC from the target task?
Basically, yeah.
> Ok, so perhaps the only distinction that makes sense is read vs. > write/control, with all checks within proc except mem_write using the > former and ptrace_attach and mem_write using the latter?
Yeah, that's what I was wondering, because maps seems to fall into the readstate category as much as fd/ does (probably fdinfo/ is closer to maps).
thanks, -chris
| |