Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks

[Greg KH <greg@kroah.com>]

On Wed, Apr 19, 2006 at 12:02:32PM -0400, Stephen Smalley wrote:
> On Wed, 2006-04-19 at 08:44 -0700, Greg KH wrote:
> > On Wed, Apr 19, 2006 at 08:55:56AM -0400, Yuichi Nakamura wrote:
> > > However, path-name based configuration can not be achieved on SELinux in
> > > following cases.
> > > 1) Files on file system that does not support xattr(such as sysfs)
> > >    SELinux policy editor handles all files as same on such file systems.
> > 
> > Hm, I've thought about this in the past and wonder if we should add
> > xattr support to sysfs.  Would it be useful for things like SELinux?
> > The files would not be created with any xattrs, but would be able to
> > have them once they are set.  Would that be good enough?
> 
> The generic security xattr fallback behavior in the VFS already provides
> us with most of what we need there.  The only thing missing is a way to
> preserve the attributes when inodes are evicted and later re-created
> from sysfs_dirent.

Yeah, without that, it's probably pretty useless :)
Take a look at the patch that added support for owner/mode settings, it
shouldn't be that hard to also add xattr support there.

> One of our people was experimenting with a patch to save and restore
> that information, but we are waiting for some of the audit work to
> finalize as that exports some interfaces from SELinux to the rest of
> the kernel that we need.

That sounds fine, thanks for letting me know.

greg k-h
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/