Also, here is one further addendum to the file_security_ops permission hook documentation. This is a caveat for security module writers that use the file_security_ops permission hook that it doesn't address the issue of revalidating permission to files that are already mapped into the process' memory. Module writers have to deal with revalidating those permissions on their own. -- Stephen D. Smalley, NAI Labs ssmalleyat_private Index: lsm/include/linux/security.h diff -u lsm/include/linux/security.h:1.85 lsm/include/linux/security.h:1.86 --- lsm/include/linux/security.h:1.85 Tue Sep 18 12:57:36 2001 +++ lsm/include/linux/security.h Tue Sep 18 13:07:41 2001 @@ -680,6 +680,12 @@ * performed, whereas the inode_security_ops hook is called * when a file is opened (as well as many other operations). * Return 0 if permission is granted. + * + * Caveat: Although this hook can be used to revalidate + * permissions for various system call operations that + * read or write files, it does not address the revalidation + * of permissions for memory-mapped files. Security modules + * must handle this separately if they need such revalidation. */ int (*permission) (struct file * file, int mask); _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Tue Sep 18 2001 - 10:19:54 PDT