linux-kernel - Re: [PATCH] Call LSM functions outside VFS helper functions.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080410121725.GP11962@parisc-linux.org>
Date:	Thu, 10 Apr 2008 06:17:25 -0600
From:	Matthew Wilcox <matthew@....cx>
To:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Cc:	viro@...iv.linux.org.uk, miklos@...redi.hu, ezk@...sunysb.edu,
	akpm@...ux-foundation.org, dave@...ux.vnet.ibm.com,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Call LSM functions outside VFS helper functions.

On Thu, Apr 10, 2008 at 09:02:57PM +0900, Tetsuo Handa wrote:
> If the conclusion became "vfsmount should not be passed to
> VFS helper functions", that's OK, but I want you to consider
> the below approach for AppArmor and TOMOYO Linux. This patch is a repost of
> http://kerneltrap.org/mailarchive/linux-fsdevel/2008/2/17/882024 .

I'm a little disappointed that you simply repost this patch rather than
responding to my post from yesterday:

> How about an approach which doesn't require the vfsmount to be passed
> down?
> 
> When the rule is put in place, say "No modifications to /etc/passwd",
> look up the inode and major:minor of /etc/passwd.  If there's a rename,
> look up the new inode number.  If it's mounted elsewhere, it doesn't
> matter, they still can't modify it because it has the same
> major:minor:inode.
> 
> Is this workable?

Could you respond to this please?

-- 
Intel are signing my paycheques ... these opinions are still mine
"Bill, look, we understand that you're interested in selling us this
operating system, but compare it to ours.  We can't possibly take such
a retrograde step."
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/