Greg KH wrote: >Ah, but Stephans program should first validate that the kernel is >running SELinux by some other method than the syscall [...] Are there race conditions here? What if someone does a 'rmmod selinux; insmod subdomain' between the time when you check for the presence of SELinux and use the syscall? It might be that an advantage of having the invoker of the syscall explicitly specify which module they expect to be handling this is that it rules out attacks like this where you might get unexpected (and hence undesired) behavior. _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Fri Aug 10 2001 - 17:52:56 PDT