Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756144AbZKWCmI (ORCPT ); Sun, 22 Nov 2009 21:42:08 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754163AbZKWCmG (ORCPT ); Sun, 22 Nov 2009 21:42:06 -0500 Received: from out01.mta.xmission.com ([166.70.13.231]:44211 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754043AbZKWCmF (ORCPT ); Sun, 22 Nov 2009 21:42:05 -0500 To: James Morris Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Stephen Smalley , Eric Paris , Tetsuo Handa References: From: ebiederm@xmission.com (Eric W. Biederman) Date: Sun, 22 Nov 2009 18:42:04 -0800 In-Reply-To: (James Morris's message of "Mon\, 23 Nov 2009 09\:18\:32 +1100 \(EST\)") Message-ID: User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-XM-SPF: eid=;;;mid=;;;hst=in01.mta.xmission.com;;;ip=76.21.114.89;;;frm=ebiederm@xmission.com;;;spf=neutral X-SA-Exim-Connect-IP: 76.21.114.89 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [RFC][PATCH] security/selinux: Simplify proc inode to security label mapping. X-SA-Exim-Version: 4.2.1 (built Thu, 25 Oct 2007 00:26:12 +0000) X-SA-Exim-Scanned: No (on in01.mta.xmission.com); Unknown failure Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1214 Lines: 29 James Morris writes: > On Fri, 20 Nov 2009, Eric W. Biederman wrote: > >> >> Currently selinux has incestuous knowledge of the implementation details >> of procfs and sysctl that it uses to get a pathname from an inode. As it >> happens the point we care is in the security_d_instantiate lsm hook so >> we have a valid dentry that we can use to get the entire pathname on >> the proc filesystem. With the recent change to sys_sysctl to go through >> proc/sys all proc and sysctl accesses go through the vfs, which >> means we no longer need a sysctl special case. > > I need to investigate this further, but one immediate issue is that > Tomoyo seems to have similar code. The Tomoyo code is currently gone in the sysctl tree (and thus in linux-next), that change was part of what got me thinking about changing selinux as well. If we can remove the selinux special case as well then we can actually remove the sysctl hook from the lsm. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/