Re: Possible system call interface for LSM

From: Greg KH (gregat_private)
Date: Fri Aug 10 2001 - 19:34:43 PDT

  • Next message: Greg KH: "Re: [patch] Socket Receive Hook"

    > > Well, now I need /proc compiled in, that's 46k.
    
    Richard, I applaud your attempts to run a machine without /proc.  I have
    tried to do this in the past and don't recommend it to anyone.  It's
    amazing how many different userspace applications rely on it.  The
    embedded world can get away with it, as they control their applications
    much better.
    
    But what's wrong with query_module(2)?  Oh yeah, your code is compiled
    into the kernel :)  Well then, you _know_ that your kernel is modified
    by you, so what's the big deal?  Add a sysctl entry if you really want
    (but again, that's an abuse of the interface and don't recommend it.)
    There are lots of other ways than to badger this poor little syscall
    into doing something it was never intended to do.
    
    >    * Group: is there perhaps a cheaper way to indicate the presence of an
    >      LSM module than a /proc entry? Or is that really the Linux Way to do
    >      this, and we should stop with the fussing?
    
    Again, query_module(2).
    
    thanks,
    
    greg k-h
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Fri Aug 10 2001 - 19:38:29 PDT