Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934675AbXHGNsP (ORCPT ); Tue, 7 Aug 2007 09:48:15 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1763143AbXHGNr7 (ORCPT ); Tue, 7 Aug 2007 09:47:59 -0400 Received: from namei.org ([69.55.235.186]:46868 "EHLO us.intercode.com.au" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1758204AbXHGNr6 (ORCPT ); Tue, 7 Aug 2007 09:47:58 -0400 X-Greylist: delayed 1447 seconds by postgrey-1.27 at vger.kernel.org; Tue, 07 Aug 2007 09:47:58 EDT Date: Tue, 7 Aug 2007 06:47:16 -0700 (PDT) From: James Morris X-X-Sender: jmorris@us.intercode.com.au To: "Serge E. Hallyn" cc: Andrew Morgan , Chris Wright , Andrew Morgan , casey@schaufler-ca.com, Andrew Morton , Stephen Smalley , KaiGai Kohei , linux-security-module@vger.kernel.org, lkml Subject: Re: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2) In-Reply-To: <20070806185231.GA21550@sergelap.austin.ibm.com> Message-ID: References: <20070806185231.GA21550@sergelap.austin.ibm.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1039 Lines: 43 On Mon, 6 Aug 2007, Serge E. Hallyn wrote: > + err = security_inode_killpriv(out->f_path.dentry, LSM_NEED_LOCK); > + if (err) > + return err; > + > err = should_remove_suid(out->f_path.dentry); > if (unlikely(err)) { > mutex_lock(&inode->i_mutex); It seems hackish to pass a needlock arg to an API, and that that we'll end up with some conceptually similar call-outs for both caps and setuid. How about encapsulating this stuff so that there's something like: err = should_remove_privs(); if (err) remove_privs(); with void remove_privs() { mutex_lock(); __remove_privs(); mutex_unlock(); } and then __remove_privs() handles the logic for all file privileges, including at this stage suid and the LSM call for file caps ? - James -- James Morris - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/