Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933413Ab2EPNmU (ORCPT ); Wed, 16 May 2012 09:42:20 -0400 Received: from mail-qc0-f174.google.com ([209.85.216.174]:34290 "EHLO mail-qc0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932403Ab2EPNmS (ORCPT ); Wed, 16 May 2012 09:42:18 -0400 Message-ID: <1337175731.2492.4.camel@localhost> Subject: Re: [PATCH] vfs: fix IMA lockdep circular locking dependency From: Eric Paris To: James Morris Cc: Linus Torvalds , Al Viro , Mimi Zohar , Mimi Zohar , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 16 May 2012 09:42:11 -0400 In-Reply-To: References: <1336963631-3541-1-git-send-email-zohar@us.ibm.com> <1337112446.20904.50.camel@falcor> <20120516004251.GO22082@ZenIV.linux.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.4.1 (3.4.1-2.fc17) Content-Transfer-Encoding: 7bit Mime-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1522 Lines: 43 On Wed, 2012-05-16 at 21:37 +1000, James Morris wrote: > On Tue, 15 May 2012, Linus Torvalds wrote: > > > Hmm? > > diff --git a/security/capability.c b/security/capability.c > index 5bb21b1c448c..9a19c6a54e12 100644 > --- a/security/capability.c > +++ b/security/capability.c > @@ -949,7 +949,6 @@ void __init security_fixup_ops(struct > security_operations *ops) > set_to_cap_if_null(ops, file_alloc_security); > set_to_cap_if_null(ops, file_free_security); > set_to_cap_if_null(ops, file_ioctl); > - set_to_cap_if_null(ops, file_mmap); > set_to_cap_if_null(ops, file_mprotect); > set_to_cap_if_null(ops, file_lock); > set_to_cap_if_null(ops, file_fcntl); > > > Do we need to add addr_map to the fixup ops? No. His patch works just fine without it. If you look he uses: + if (security_ops->mmap_file) { Which means since we didn't set an explicit .mmap_file, even with no other LSM loaded we would be fine. At the moment I'd rather stick with our usual notation of forcing capabilities to define every option even if all it does it return 0. If Linus thinks it's a good idea to do if (security_ops->function) security_ops->funtion(args); In the security server we should do that cleanup separately... -Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/