Re: [AppArmor 38/45] AppArmor: Module and LSM hooks

[Pavel Machek <pavel@ucw.cz>]

Hi!

> > > You very well know that the vfs has a limit of PATH_MAX characters (4096)
> > > for pathnames. This means that at most that many characters can be passed
> > > at once.
> 
> What users can do is something like this:
> 
>   chdir("some/long/path");
>   chdir("some/even/longer/path");
>   ...
> 
> and the total length of the path can then exceed PATH_MAX characters. We can 
> only accept pathnames up to some upper limit, and we need to somehow define 
> what that limit is supposed to be. We could use PATH_MAX or some other 
> arbitrary number. In most situations PATH_MAX will be fine, but that's not 
> always guaranteed to be the case. So what's wrong about making this 
> configurable for special situations that we might run into? Module parameters 
> are *really* dead cheap.

Parameters are cheap, but this one is ugly.

How will kernel work with very long paths? I'd suspect some problems,
if path is 1MB long and I attempt to print it in /proc
somewhere. Perhaps vfs should be modified not to allow such crazy
paths? But placing limit in aa is ugly.
								Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/