Re: [TOMOYO 05/15](repost) Domain transition handler functions.

[Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>]

About use of singly-linked list:

What my SLL (singly-linked list) holds is bit different from other lists.

Almost all lists hold list of elements (e.g. buffer) that are used *temporarily*.
Thus, adding to the list and removing from the list are essential.

My SLL holds ACL (access control list) entries that are used *permanently*
(i.e. throughout the kernel's lifetime).
These ACL entries are policy used for MAC (mandatory access control).
You don't change MAC's policy without clear reason, do you?
Therefore, ACL entries of MAC's policy seldom need to be removed.

So I wonder
"Remodeling the mechanism of holding ACL entries to support removal of individual entry
 worth the cost of reference-counter manipulation and the risk of dead-pointers?"

Your next question would be
"Why are you using SLL for holding elements that are used *permanently*?"
"Why not allocate a large memory block and hold all elements in that block?"
Yes, you are right. But I can't do so.
The reason is explained in "policy file handling" at http://lkml.org/lkml/2007/10/2/56 .



About use of list that can't remove elements:

I think that many of you are misunderstanding about
"When entries are automatically appended to a list".

If you run the system in "learning mode" *forever*,
it will consume all memory; so DoS attacks are possible.

But please be aware that entries are automatically appended
only while you are running the system in "learning mode".
Also, there is a safeguard mechanism that controls upper limit.
These lists consume less than some hundreds KB
for embedded systems and/or targeted protection of PC systems,
less than 1 MB for complete protection of PC systems.
You can see how much memory is used for holding ACL entries
via /sys/kernel/security/tomoyo/meminfo interface
and you will find that these lists won't consume all memory in your system.

When you are running the system in "enforcing mode",
no entries are appended automatically; so DoS attacks are impossible.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/