Re: Kernel Security Extensions USENIX BOF Summary - pathnames

Previous message: Valdis.Kletnieksat_private: "Re: LSM Patch Additions for CAPP (C2) Audit Trails"
In reply to: Crispin Cowan: "Re: Kernel Security Extensions USENIX BOF Summary"
Next in thread: jmjonesat_private: "Re: Kernel Security Extensions USENIX BOF Summary"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

aoat_private

On Mit, 04 Jul 2001 Crispin Cowan wrote:
> I'd like to better understand this suggestion.  Various modules (DTE,
> SubDomain) really do need the absolute path of the file being accessed.  If
> there is not a hook that provides that information, then there needs to be a
> way to reconstruct the info.  I'm assuming that "Doug's suggestion" is such a
> means?

The more general term might be 'access the parent object from anywhere', by
which the absolute path can be reconstructed.

Doug's suggestion of placing new pointers to parents is a possible solution.
(Did I get that right?) Currently, RSBAC for 2.4 kernels keeps such a pointer
internally.

As an example, several RSBAC models combine values from an explicit label with
those from an inherited (implicit) one to get the final values. For this,
access to all parent dentries (up to /) from the current context is enevitable.

Amon.

_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module