| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 12 Dec 2007 18:34:26 +0000 From: David Howells <dhowells@...hat.com> To: casey@...aufler-ca.com Cc: dhowells@...hat.com, Stephen Smalley <sds@...ho.nsa.gov>, Karl MacMillan <kmacmill@...hat.com>, viro@....linux.org.uk, hch@...radead.org, Trond.Myklebust@...app.com, linux-kernel@...r.kernel.org, selinux@...ho.nsa.gov, linux-security-module@...r.kernel.org Subject: Re: [PATCH 08/28] SECURITY: Allow kernel services to override LSM settings for task actions [try #2] Casey Schaufler <casey@...aufler-ca.com> wrote: > What sort of authorization are you thinking of? I would expect > that to have been done by cachefileselinuxcontext (or > cachefilesspiffylsmcontext) up in userspace. If you're going to > rely on userspace applications for policy enforcement they need > to be good enough to count on after all. It can't be done in userspace, otherwise someone using the cachefilesd interface can pass an arbitrary context up. The security context has to be passed across the file descriptor attached to /dev/cachefiles along with the other configuration parameters as a text string. This fd selects the particular cache context that a particular instance of a running daemon is using. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists