linux-kernel - Re: [PATCH] 2.6.38: access permission filesystem 0.25

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 24 Apr 2011 12:09:24 -0700
From:	Randy Dunlap <randy.dunlap@...cle.com>
To:	Olaf Dietsche <olaf+list.linux-kernel@...fdietsche.de>
CC:	linux-kernel@...r.kernel.org, Rod Cordova <rcordova@...ernet.org>
Subject: Re: [PATCH] 2.6.38: access permission filesystem 0.25

On 04/11/11 13:47, Olaf Dietsche wrote:
> Randy Dunlap <randy.dunlap@...cle.com> writes:
> 
>> +config ACCESSFS_USER_PORTS
>> +	tristate "User permission based IP ports"
>> +	depends on ACCESS_FS
>> +	select NET_HOOKS
>> +	default n
>> +	help
>> +	  If you say Y here, you will be able to control access to IP ports
>> +	  based on user-/groupid. For this to work, you must say Y
>> +	  to CONFIG_NET_HOOKS.
>>
>> That last sentence is handled (in theory) by "select NET_HOOKS", right?
>>
>> But NET_HOOKS depends on INET && EXPERIMENTAL, so this config should not
>> select NET_HOOKS unless INET && EXPERIMENTAL are enabled also.
> 
> Thanks for spotting this. Fixed version is below and at 

+config ACCESSFS_USER_PORTS
+	tristate "User permission based IP ports"
+	depends on ACCESS_FS && INET
+	select NET_HOOKS
+	default n
+	help
+	  If you say Y here, you will be able to control access to IP ports
+	  based on user-/groupid. For this to work, you must say Y
+	  to CONFIG_NET_HOOKS.

The last sentence of help text is unneeded and could be confusing to a user
since the "select NET_HOOKS" is already done above.


Have you built this lately?  There have been a few vfs changes recently.
Building on 2.6.39-rc4, I get this:

/lnx/src/lnx-2639-rc4/fs/accessfs/inode.c: In function 'accessfs_get_sb':
/lnx/src/lnx-2639-rc4/fs/accessfs/inode.c:363: error: implicit declaration of function 'get_sb_single'
/lnx/src/lnx-2639-rc4/fs/accessfs/inode.c: At top level:
/lnx/src/lnx-2639-rc4/fs/accessfs/inode.c:404: error: unknown field 'get_sb' specified in initializer
/lnx/src/lnx-2639-rc4/fs/accessfs/inode.c:404: warning: initialization makes integer from pointer without a cast
/lnx/src/lnx-2639-rc4/fs/accessfs/inode.c:404: error: initializer element is not computable at load time
/lnx/src/lnx-2639-rc4/fs/accessfs/inode.c:404: error: (near initialization for 'accessfs_fs_type.fs_flags')


> <http://www.olafdietsche.de/linux/accessfs/>
> 
> Regards, Olaf
> 
>  Documentation/filesystems/accessfs.txt |   41 +++
>  fs/Kconfig                             |    1 +
>  fs/Makefile                            |    1 +
>  fs/accessfs/Kconfig                    |   63 +++++
>  fs/accessfs/Makefile                   |   11 +
>  fs/accessfs/capabilities.c             |  108 ++++++++
>  fs/accessfs/inode.c                    |  432 ++++++++++++++++++++++++++++++++
>  fs/accessfs/ip.c                       |  101 ++++++++
>  include/linux/accessfs_fs.h            |   42 +++
>  include/net/sock.h                     |   43 ++++
>  net/Kconfig                            |   12 +
>  net/Makefile                           |    1 +
>  net/hooks.c                            |   55 ++++
>  net/ipv4/af_inet.c                     |    2 +-
>  net/ipv6/af_inet6.c                    |    2 +-
>  15 files changed, 913 insertions(+), 2 deletions(-)


-- 
~Randy
*** Remember to use Documentation/SubmitChecklist when testing your code ***
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/