Re: permissive vs. restrictive issue and solutions...

Previous message: Stephen Smalley: "notify_change and the setattr hook"
In reply to: Stephen Smalley: "Re: permissive vs. restrictive issue and solutions..."
Next in thread: David Wagner: "Re: permissive vs. restrictive issue and solutions..."
Next in thread: Chris Wright: "Re: permissive vs. restrictive issue and solutions..."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

chrisat_private

* Stephen Smalley (sdsat_private) wrote:
> 
> On Tue, 5 Jun 2001, Chris Wright wrote:
> 
> > as a minor nitpick... making a static inline function in sched.h that
> > calls security_ops->capable() will not work without fully exporting
> > the security_ops structure (there are _many_ calls to capable() in
> > drivers/modules).  in lieu of exporting the security_ops structure to
> > modules, we _can_ (and do) export a function capable() (neither static
> > nor inline) that calls security_ops->capable().
> 
> Isn't this also applicable to compute_creds?  What about binary format
> implementations that exist as modules and need to call compute_creds?
> Don't you need to keep an exported compute_creds function that 
> calls security_ops->bprm_ops->compute_creds?  That would also
> allow you to revert your changes to the various compute_creds
> calls.

Yes, you are right.  Thanks for pointing this out.  I will revert the
changes.

-chris

_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module