Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S269884AbUIDLMM (ORCPT ); Sat, 4 Sep 2004 07:12:12 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S269883AbUIDLKS (ORCPT ); Sat, 4 Sep 2004 07:10:18 -0400 Received: from imladris.demon.co.uk ([193.237.130.41]:6662 "EHLO phoenix.infradead.org") by vger.kernel.org with ESMTP id S269882AbUIDLKD (ORCPT ); Sat, 4 Sep 2004 07:10:03 -0400 Date: Sat, 4 Sep 2004 12:09:58 +0100 From: Christoph Hellwig To: =?iso-8859-1?Q?Kristian_S=F8rensen?= Cc: umbrella-devel@lists.sourceforge.net, Linux Kernel Mailing List Subject: Re: [Umbrella-devel] Re: Getting full path from dentry in LSM hooks Message-ID: <20040904120958.B14123@infradead.org> Mail-Followup-To: Christoph Hellwig , =?iso-8859-1?Q?Kristian_S=F8rensen?= , umbrella-devel@lists.sourceforge.net, Linux Kernel Mailing List References: <41385FA5.806@cs.aau.dk> <20040903133238.A4145@infradead.org> <413865B4.7080208@cs.aau.dk> <20040903140449.A4253@infradead.org> <41386FB7.2060804@cs.aau.dk> <20040903150111.A4884@infradead.org> <4138CBEF.9000909@cs.aau.dk> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.2.5.1i In-Reply-To: <4138CBEF.9000909@cs.aau.dk>; from ks@cs.aau.dk on Fri, Sep 03, 2004 at 09:54:23PM +0200 X-SRS-Rewrite: SMTP reverse-path rewritten from by phoenix.infradead.org See http://www.infradead.org/rpr.html Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1142 Lines: 24 On Fri, Sep 03, 2004 at 09:54:23PM +0200, Kristian S?rensen wrote: > >>We are working on a project called Umbrella, (umbrella.sf.net) which > >>implements processbased mandatory accesscontrol in the Linux kernel. > >>This access control is controlled by "restriction", e.g. by restricting > >> some process from accessing any given file or directory. > >> > >>E.g. if a root owned process is restricted from accessing /var/www, and > >>the process is compromised by an attacker, no mater what he does, he > >>would not be able to access this directory. > > > > > > mount --bind /var/www /home/joe/p0rn/, and then? > Actually this "attack" is avoided, because restrictions are enherited, > from parent proces to its children. If you restrict your process on the path /var/ww/ but the same objects are also available below a different path, what does that have to do with child processes? - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/