Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932084AbaF3QGC (ORCPT ); Mon, 30 Jun 2014 12:06:02 -0400 Received: from mail-lb0-f169.google.com ([209.85.217.169]:64726 "EHLO mail-lb0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753601AbaF3QF7 (ORCPT ); Mon, 30 Jun 2014 12:05:59 -0400 MIME-Version: 1.0 In-Reply-To: <1404124096-21445-10-git-send-email-drysdale@google.com> References: <1404124096-21445-1-git-send-email-drysdale@google.com> <1404124096-21445-10-git-send-email-drysdale@google.com> From: Andy Lutomirski Date: Mon, 30 Jun 2014 09:05:38 -0700 Message-ID: Subject: Re: [PATCH 09/11] capsicum: implementations of new LSM hooks To: David Drysdale Cc: LSM List , "linux-kernel@vger.kernel.org" , Greg Kroah-Hartman , Alexander Viro , Meredydd Luff , Kees Cook , James Morris , Linux API Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jun 30, 2014 at 3:28 AM, David Drysdale wrote: > If the LSM does not provide implementations of the .file_lookup and > .file_install LSM hooks, always use the Capsicum implementations. > > The Capsicum implementation of file_lookup checks for a Capsicum > capability wrapper file and unwraps to if the appropriate rights > are available. > > The Capsicum implementation of file_install checks whether the file > has restricted rights associated with it. If it does, it is replaced > with a Capsicum capability wrapper file before installation into the > fdtable. I think I fall on the "no LSM" side of the fence. This kind of stuff should be available regardless of selected LSM (as it is in your code), but until someone has a use case for the LSM hooks in real LSMs, I don't really see the point. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/