linux-kernel - Re: [patch 00/11] mount ownership and unprivileged mount syscall (v9)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 18 Mar 2008 12:33:02 +0100
From:	Miklos Szeredi <miklos@...redi.hu>
To:	jmorris@...ei.org
CC:	miklos@...redi.hu, akpm@...ux-foundation.org, hch@...radead.org,
	serue@...ibm.com, viro@...iv.linux.org.uk,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	sds@...ho.nsa.gov, eparis@...hat.com,
	linux-security-module@...r.kernel.org
Subject: Re: [patch 00/11] mount ownership and unprivileged mount syscall
 (v9)

> Something to consider down the track would be how to possibly allow this 
> with SELinux, which only knows about normal mounts.

Right.

> We might need a user_mount hook which is called once the core kernel code 
> determines that it is a a valid unprivileged mount (although the sb_mount 
> hook will already have been called, IIUC).

Does the order matter between core code's and the security module's
permission checks?  If it does, the cleanest would be to just move the
core checks before the sb_mount hook, no?

Miklos
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/