linux-kernel - Re: [RFC][PATCH 3/6] SLIM main patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 14 Jul 2006 14:52:30 -0500
From:	"Serge E. Hallyn" <serue@...ibm.com>
To:	Dave Hansen <haveblue@...ibm.com>
Cc:	Kylene Jo Hall <kjhall@...ibm.com>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	LSM ML <linux-security-module@...r.kernel.org>,
	Dave Safford <safford@...ibm.com>,
	Mimi Zohar <zohar@...ibm.com>, Serge Hallyn <sergeh@...ibm.com>
Subject: Re: [RFC][PATCH 3/6] SLIM main patch

Quoting Dave Hansen (haveblue@...ibm.com):
> > +static void revoke_file_wperm(struct slm_file_xattr *cur_level)
> > +{
> > +	int i, j = 0;
> > +	struct files_struct *files = current->files;
> > +	unsigned long fd = 0;
> > +	struct fdtable *fdt;
> > +	struct file *file;
> > +
> > +	if (!files || !cur_level)
> > +		return;
> > +
> > +	spin_lock(&files->file_lock);
> > +	fdt = files_fdtable(files);
> > +
> > +	for (;;) {
> > +		i =j * __NFDBITS;
> > +		if ( i>= fdt->max_fdset || i >= fdt->max_fds)
> > +			break;
> > +		fd = fdt->open_fds->fds_bits[j++];
> > +		while(fd) {
> > +			if (fd & 1) {
> > +				file = fdt->fd[i++];
> > +				if (file && file->f_dentry)
> > +					do_revoke_file_wperm(file, cur_level);
> > +			}
> > +			fd >>= 1;
> > +		}
> > +	}
> > +	spin_unlock(&files->file_lock);
> > +}
> 
> This is an awfully ugly function ;)
> 
> Instead of actually walking the fd table and revoking permissions, would
> doing a hook in generic_write_permission() help?  It might be easier to
> switch back and forth.

Or, would using security_file_permission(), which is called on each read
and write to an open file, suffice?  Would it perform as well as this
way?

-serge
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/