lkml.org 
[lkml]   [2016]   [Dec]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v1] security: Add a new hook: inode_touch_atime
On Thu, Dec 22, 2016 at 01:01:39AM +0100, Mickaël Salaün wrote:

> SELinux should be interested. This is useful to create sandboxes so
> other LSM may be interested too
>
> I'm working on a new LSM and I would like this kind of hook to create a
> real read-only environment.

What the...? Have you noticed
if (!sb_start_write_trylock(inode->i_sb))
return;

if (__mnt_want_write(mnt) != 0)
goto skip_update;
in touch_atime()? Just mount them read-only in your sandbox (on either
level - both per-mountpoint and per-fs r/o will do) and be done
with that; why bother with LSM when regular tools would suffice?

\
 
 \ /
  Last update: 2016-12-22 01:58    [W:0.475 / U:0.140 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site