linux-kernel - Re: [AppArmor 01/44] Pass struct vfsmount to the inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200707040028.30273.agruen@suse.de>
Date:	Wed, 4 Jul 2007 00:28:30 +0200
From:	Andreas Gruenbacher <agruen@...e.de>
To:	Christoph Hellwig <hch@...radead.org>
Cc:	jjohansen@...e.de, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org, Tony Jones <tonyj@...e.de>,
	Dave Hansen <hansendc@...ibm.com>
Subject: Re: [AppArmor 01/44] Pass struct vfsmount to the inode_create LSM hook

On Saturday 30 June 2007 11:29, Christoph Hellwig wrote:
> On Tue, Jun 26, 2007 at 04:07:57PM -0700, jjohansen@...e.de wrote:
> > This is needed for computing pathnames in the AppArmor LSM.
>
> Please see the various per-mountpoint r/o thread that NACKed all the
> vfsmount additions and have the rationale for it.

The per-mountpoint flags can be checked at the vfs level instead of checking 
down in the filesystems. That's all pretty nice; it avoids a number of 
problems. (I think the latest patches of Dave Hansen are archived at 
http://lwn.net/Articles/239630/.)

The lSM hooks are a rather different story: we cannot move LSM functionality 
into the vfs without breaking the LSM abstraction. LSMs already are not 
agnostic of vfsmount anymore right now. They are free to use the additional 
vfsmounts, or just ignore them.

So what are the specific issues you have with this?

Thanks,
Andreas
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/