lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 13 Dec 2007 15:36:59 +0000 From: David Howells <dhowells@...hat.com> To: Stephen Smalley <sds@...ho.nsa.gov> Cc: dhowells@...hat.com, casey@...aufler-ca.com, Karl MacMillan <kmacmill@...hat.com>, viro@....linux.org.uk, hch@...radead.org, Trond.Myklebust@...app.com, linux-kernel@...r.kernel.org, selinux@...ho.nsa.gov, linux-security-module@...r.kernel.org Subject: Re: [PATCH 08/28] SECURITY: Allow kernel services to override LSM settings for task actions [try #2] Stephen Smalley <sds@...ho.nsa.gov> wrote: > It is just a way of carving up the permission space, typically based on > object type, but it can essentially be arbitrary. The check in this > case seems specific to cachefiles since it is controlling an operation > on the /dev/cachefiles interface that only applies to cachefiles > internal operations, so making a cachefiles class seems reasonable. Can you specify what sort of permissions you're thinking of providing for tasks to operate on this class? Can an object of this class 'operate' on other objects, or can only process-class objects do that? How does an object of this class acquire a label? What is an object of this class? Is it a "cache"? Or were you thinking of a "module"? David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists