TOMOYO Linux is a pathname-based MAC extension (LSM module) for the
Linux kernel.
Since the latest mmotm (2008-10-02-16-17) lacks CRED patchset by
David Howells, we used linux-next (-next-20080919) which includes
CRED patchset.
Diffrences from previous version are as follows.
*about LSM interfaces:
-added a new LSM hook security_path_clear() for clearing hash
table after VFS helper functions. It is needed to perform DAC
before MAC.
-added a new config option CONFIG_SECURITY_PATH for new LSM hooks.
*about task_struct:
-added in_execve flag to allow LSM modules to determine whether
current process is in an execve operation or not so that they can
behave differently while an execve operation is in progress.
*about TOMOYO body:
-made security_inode_*() return result of security_path_*() and
removed code clone of DAC.
-modified to check permisson of interpreter using
bprm->cred->security and current->in_execve flag.
-modified to use get_task_cred() for reading objective LSM context
of a task.
-modified to use bprm->cred->security to know the first call of
security_bprm_check() .
-modified to pass current->cred->security or bprm->cred->security as
parameter.
Thanks to Serge for sugguesting DAC-before-MAC workaround.
Thanks to David for patiently reviewing in_execve patch.
Stephen, James, Chris, please review and respond (hopefully Ack).
Regards,
--