Re: Changes to LSM phase 1 for audit.

From: Greg KH (gregat_private)
Date: Wed Jul 18 2001 - 10:02:10 PDT

  • Next message: Tim Fraser: "LSM BOF at USENIX Security Symposium"

    On Wed, Jul 18, 2001 at 09:40:27AM -0700, Casey Schaufler wrote:
    > 
    > You really want both. The fd is the name by which the process
    > refers to the object. If the file is unlinked (has a link count
    > of 0) there is no pathname which is associated with it, and
    > it would be erronious to report the pathname which it had when
    > it was opened. We also have the case of pseudo file systems, where
    > the inode number is just as transient as the fd. A good audit
    > analysis tool is going to be able to answer querys based on fd,
    > such as "where did this Trojan Horse get stdin from?".
    > It does an audit system a lot of good to have the fd, and
    > it is trivial to provide.
    
    Since the fd is only needed for audit, can we agree that this change
    will be postponed until "stage 2"?
    
    thanks,
    
    greg k-h
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Wed Jul 18 2001 - 10:07:28 PDT