linux-kernel - Re: [PATCH 08/14] NFSv4: Add label recommended attribute and NFSv4 flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LRH.2.00.0904031921320.11240@tundra.namei.org>
Date:	Fri, 3 Apr 2009 19:31:03 +1100 (EST)
From:	James Morris <jmorris@...ei.org>
To:	"David P. Quigley" <dpquigl@...ho.nsa.gov>
cc:	hch@...radead.org, viro@...iv.linux.org.uk, casey@...aufler-ca.com,
	sds@...ho.nsa.gov, "Matthew N. Dodd" <matthew.dodd@...rta.com>,
	trond.myklebust@....uio.no, bfields@...ldses.org,
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	linux-security-module@...r.kernel.org, selinux@...ho.nsa.gov,
	labeled-nfs@...ux-nfs.org
Subject: Re: [PATCH 08/14] NFSv4: Add label recommended attribute and NFSv4
 flags

On Wed, 26 Nov 2008, David P. Quigley wrote:

> diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
> index ea03667..144eacf 100644
> --- a/include/linux/nfs4.h
> +++ b/include/linux/nfs4.h
> @@ -21,6 +21,7 @@
>  #define NFS4_FHSIZE		128
>  #define NFS4_MAXPATHLEN		PATH_MAX
>  #define NFS4_MAXNAMLEN		NAME_MAX
> +#define NFS4_MAXLABELLEN	4096

I can't recall if this has been discussed before, but why is the label 
length limited to this value?

SELinux on-disk labels can be up to 64KB in size (XATTR_SIZE_MAX), and I'd 
like to ensure that we don't end up with an unnecessary disk vs. network 
label size incompatibility.

While it seems unlikely that SELinux (and other forms of MAC) security 
labels would currently exceed 4K, we don't know how SELinux might be 
extended in the future, and should avoid limiting label flexibility 
beyond existing constraints.


- James
-- 
James Morris
<jmorris@...ei.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/