Messages in this thread | | | From | Linus Torvalds <> | Date | Wed, 16 May 2012 08:23:19 -0700 | Subject | Re: [PATCH] vfs: fix IMA lockdep circular locking dependency |
| |
On Wed, May 16, 2012 at 7:06 AM, Eric Paris <eparis@parisplace.org> wrote: > > But it would be flat wrong to put it there. True historically we did > things differently, but this patch is right given Linus is doing it a > different way.
Indeed. As Eric points out, I'm forcing the address capability checks on everybody, so defaulting to them is actively the wrong thing to do.
I think the NULL pointer games are from back when we inlined the security hooks into the code directly, rather than have out-of-line helper functions. At that point, the code expansion overhead of loading the pointer, checking it for NULL, and then calling it was quite noticeable.
But we uninlined them in 2007 (commit 20510f2f4e2d: "security: Convert LSM into a static interface"), so I think the "set to default so that you can do an unconditional jump" is not all that useful any more.
Of course, if all security models do export the fn, not having the conditional is still useful. But defaulting to the capability one is not in this case, since we will call the capability version later anyway. So it should be defaulted to something that just returns 0.
Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |