linux-kernel - Re: [PATCH] Smack: SMACK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1314380186.25778.30.camel@moss-pluto>
Date:	Fri, 26 Aug 2011 13:36:26 -0400
From:	Stephen Smalley <sds@...ho.nsa.gov>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
Cc:	Eric Paris <eparis@...isplace.org>,
	Jarkko Sakkinen <jarkko.sakkinen@...el.com>,
	Casey Schaufler <casey@...aufler-ca.com>,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH] Smack: SMACK_IOCLOADACCESS

On Fri, 2011-08-26 at 14:14 +0100, Alan Cox wrote:
> > good in that it only takes 1 syscall and ours takes 2.  Your interface
> > is bad in that it is ioctl and we are told since birth that we must
> > hate them no matter what (not that read/write is really any
> > different).  It isn't the same method the only other LSM I know about
> > uses.  It can only every return one value (ok, I know ioctl can be
> > made to do anything at all)
> 
> I'm all in favour of the use of brains rather than the cult of ioctl
> hating. You can design bad ioctls and good ones. Also ioctl is pretty
> much unique in being bidirectional, it allows a query/respose action
> without having to worry about whether the respose is the one to your
> query or another parallel query.

The transaction ops achieve that property as well - the response is
stored in an open file private buffer and thus can only correspond to a
request written to that same open file instance.

-- 
Stephen Smalley
National Security Agency

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/