On Tuesday, August 28 2007 6:39:13 am Tetsuo Handa wrote:
> Hello.
Hello.
> Paul Moore wrote:
> > > * post_recv_datagram is added in skb_recv_datagram.
> >
> > Can you explain to me why this is not possible using the existing
> > security_socket_sock_rcv_skb() LSM hook?
>
> socket_sock_rcv_skb() is a hook for enqueue time.
> I want a hook for dequeue time, because what TOMOYO Linux is doing is
> not "whether a socket created by foo is permitted to pick up
> an incoming packet from specific address/port"
> but "whether bar is permitted to pick up
> an incoming packet from specific address/port".
> At the time of enqueue, I can't know who will pick up that packet.
>
> Same reason for socket_post_accept(). What TOMOYO Linux is doing is
> not "whether a socket created by foo is permitted to accept
> a connection request from specific address/port"
> but "whether bar is permitted to accept
> a connection request from specific address/port".
> At the time of enqueue, I can't know who will pick up that request.
I apologize for not recognizing your approach from our earlier discussion on
the LSM mailing list in July. Unfortunately, I have the same objections to
these changes that I did back then and from what I can recall of the
discussion the rest of the kernel networking community agreed that these
changes are not the preferred way of solving this problem. We offered
suggestions on how to accomplish your goals in a way that would be acceptable
upstream and I would encourage you to investigate those options further.
--
paul moore
linux security @ hp
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
