Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758168AbZKYImD (ORCPT ); Wed, 25 Nov 2009 03:42:03 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752435AbZKYImA (ORCPT ); Wed, 25 Nov 2009 03:42:00 -0500 Received: from tundra.namei.org ([65.99.196.166]:51557 "EHLO tundra.namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752123AbZKYImA (ORCPT ); Wed, 25 Nov 2009 03:42:00 -0500 Date: Wed, 25 Nov 2009 19:41:48 +1100 (EST) From: James Morris To: "Eric W. Biederman" cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Stephen Smalley , Eric Paris Subject: Re: [RFC][PATCH] security/selinux: Simplify proc inode to security label mapping. In-Reply-To: Message-ID: References: User-Agent: Alpine 2.00 (LRH 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1335 Lines: 37 On Fri, 20 Nov 2009, Eric W. Biederman wrote: > > Currently selinux has incestuous knowledge of the implementation details > of procfs and sysctl that it uses to get a pathname from an inode. As it > happens the point we care is in the security_d_instantiate lsm hook so > we have a valid dentry that we can use to get the entire pathname on > the proc filesystem. With the recent change to sys_sysctl to go through > proc/sys all proc and sysctl accesses go through the vfs, which > means we no longer need a sysctl special case. > > So get the path for the dentry, remove the incestuous knowledge > and simplify the code. > > caveat: Because the dentry may not yet be hashed I think dentry_path will > append (deleted) and thus is not the right function to call. This seems to break labeling. Prior to this patch, I see: # ls -lZ /proc/1/net/rpc/nfsd.fh -rw-------. root root system_u:object_r:sysctl_rpc_t:s0 channel with the patch: # ls -lZ /proc/1/net/rpc/nfsd.fh -rw-------. root root system_u:object_r:proc_t:s0 channel -- James Morris -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/