Re: permissive vs. restrictive issue and solutions...

From: Stephen Smalley (sdsat_private)
Date: Thu Jun 07 2001 - 07:31:55 PDT

  • Next message: Stephen Smalley: "notify_change and the setattr hook"

    On Tue, 5 Jun 2001, Chris Wright wrote:
    
    > as a minor nitpick... making a static inline function in sched.h that
    > calls security_ops->capable() will not work without fully exporting
    > the security_ops structure (there are _many_ calls to capable() in
    > drivers/modules).  in lieu of exporting the security_ops structure to
    > modules, we _can_ (and do) export a function capable() (neither static
    > nor inline) that calls security_ops->capable().
    
    Isn't this also applicable to compute_creds?  What about binary format
    implementations that exist as modules and need to call compute_creds?
    Don't you need to keep an exported compute_creds function that 
    calls security_ops->bprm_ops->compute_creds?  That would also
    allow you to revert your changes to the various compute_creds
    calls.
    
    --
    Stephen D. Smalley, NAI Labs
    ssmalleyat_private
    
    
    
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Thu Jun 07 2001 - 07:33:27 PDT