lkml.org 
[lkml]   [2008]   [Jul]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch] security: fix dummy xattr functions
On Wed, 2 Jul 2008, Miklos Szeredi wrote:

> So where do the dummy_ functions figure into this? As I understand,
> they are called whenever LSM is disabled, but the LSM doesn't define a
> particular hook, so there's a default implementation. Is that correct?

If LSM is disabled, nothing is called (the security hooks are optimized
away). It's for when LSM is enabled, but there is either no LSM module
selected, or as fallbacks for hooks which are not implemented by an LSM
module.

> If so, then in theory it is still theoretically possible that with
> LSM+capabilities, the LSM doesn't explicitly stack inode_setxattr and
> inode_removexattr, and so the dummy implementation should do that
> instead. What am I missing?

The LSM is responsible for performing this stacking (or not), depending on
which particular security models are desired. It may, for example, not
want filesystem capabilities.

I guess it might be safer to force the LSM to override fs capabilities if
it doesn't want them, but I'd like to see what others think.


- James
--
James Morris
<jmorris@namei.org>


\
 
 \ /
  Last update: 2008-07-02 11:19    [W:0.697 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site