Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S967181Ab2EPAiK (ORCPT ); Tue, 15 May 2012 20:38:10 -0400 Received: from mail-wi0-f178.google.com ([209.85.212.178]:45880 "EHLO mail-wi0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758480Ab2EPAiI (ORCPT ); Tue, 15 May 2012 20:38:08 -0400 MIME-Version: 1.0 In-Reply-To: References: <1336963631-3541-1-git-send-email-zohar@us.ibm.com> <1337112446.20904.50.camel@falcor> From: Linus Torvalds Date: Tue, 15 May 2012 17:37:46 -0700 X-Google-Sender-Auth: tP2qzdDy7JRc0FFVMOkpLio5QDo Message-ID: Subject: Re: [PATCH] vfs: fix IMA lockdep circular locking dependency To: Mimi Zohar Cc: Eric Paris , Mimi Zohar , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Al Viro Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1302 Lines: 28 So here's a COMPLETELY UNTESTED patch that does what I think might be the right thing. To simplify the calling convention, I'm just making the security layer compute the whole "requested protections" vs "actual protections". It might be a good idea to have a helper function to do that, of course, but that sounds like an independent cleanup (the mprotect() code also has this same logic, and does it incompletely). It does change some things, like say that "->mmap_file()" is only ever called for actual files, not for anonymous mappings. It doesn't seem to be sensible to have a security model for anonymous mappings - there's nothing there to really target. Whatever. It also makes security_mmap_addr() always call the standard capability check (*after* having called the security model version), so the security model no longer needs to care. All of them did seem to do so. And again: this is totally untested. I'm not committing this, it's more of a "hey, I tried it out, might as well send it out for comments" thing. Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/