Inodes hooks example

Previous message: Magosányi Árpád: "Re: [lin-sec-mod] Re: Direction of the mailing list/effort"
Next in thread: Serge E. Hallyn: "Re: Inodes hooks example"
Reply: Serge E. Hallyn: "Re: Inodes hooks example"
Reply: Andrew Morgan: "Re: Inodes hooks example"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

gregat_private

I've taken Chris's header file and implemented where I think the
inode_ops hooks should go into the kernel.  Attached to this message is
a patch against 2.4.3 that does this (it also contains some other stuff,
including the dummy security module plug, and a shell to put the
capabilities module into for people to get an idea of what I am thinking
for these necessary functions.)

I'm looking for feedback on this:
	- do these hooks look sufficient for what everyone wants to do
	  with regards to inode operations?
	- have I placed the hooks in good places? (I'm not happy about
	  with where the setattr() hook is, I really don't want any of
	  these to be called within any kernel lock.  This one violates
	  that.)
	- have I done anything real dumb with these hooks?
	- anything else people want to comment on.

I'm currently typing this on a box that is running this patch, so it
does actually work :)

SubDomain seems to like where these hooks are (actually makes the
SubDomain code smaller, which makes me happy) and they don't really
effect the capabilities module (although capabilities are still in the
kernel with this patch.)

As for the whole self-modifying thread, show me the code.  Doing that is
a _huge_ pain in the butt to get working across all platforms properly,
and there's the fun problem of architectures that don't allow writable
code segments :)  Remember Linux is not i386 specific...
Doing the hooks like I have done is fast, and is how Linus has said he
wants them to look.

I haven't run any benchmarks on this right now, but if I get the chance
tomorrow I will (the second pointer dereference will be removed at the
end, but it makes for a nice abstraction at this point in time.  That
removes a few instructions.)

The patch contains:
	720 lines added
	63 lines removed

Comments?  Flames?  Contrasting visions?  Praise?

thanks,

greg k-h

-- 
greg@(kroah|wirex).com
http://immunix.org/~greg