Re: intercepting system calls

From: Scott Leerssen (leerssenat_private)
Date: Mon Apr 16 2001 - 06:36:14 PDT

  • Next message: Philippe Biondi: "Re: ideas on interface (was Be careful please)"

    Neil Bortnak wrote:
    > 
    > Scott Leerssen wrote:
    > >
    > > Jesse Pollard wrote:
    > > >
    > > > A file may have its permissions changed to deny the process access. In the
    > > > current method, access is only checked on open. So once a process does a
    > > > fork+exec (optionally with setuid..) access to the given file should no
    > > > longer be allowed.
    > >
    > > I disagree with this scenario.  In trusted programming, there are often
    > > times when you want to gain access to a file/socket via a privileged
    > > process and then pass along the descriptor to an less privileged
    > > process.  Monitoring read/write is more secure, but far from practical
    > > in most cases.
    > 
    > I don't think it would hurt to put in security hooks to the read/write
    > functions. If no security module makes use of them, then there really
    > isn't any performance hit. If a paranoid module wants to slow I/O down
    > by 10%, that's it's perogative.
    > 
    > Neil
    
    I agree.  I need to make better use of the "reply-all" button and not
    worry about policy.  After all, flexible policy is what this is all
    about.
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Mon Apr 16 2001 - 06:44:47 PDT