On Wed, 6 Feb 2002, Huagang Xie wrote: > Is there any hook that I can use to do this? or will LSM support to add a > hook for this in the future? like > > one way is to add a paramter to current implementation, > security_ops->bprm_ops->alloc_security(&bprm, envp); That would be unsafe, since 'envp' is a userspace pointer. If your security module performed a check based on it, then there could be a TOCTTOU flaw. > or > a new hook after the copy_string() > > security_ops->bprm_ops->post_alloc_security(&bprm); This seems preferable, although it should use a more descriptive name. I assume that you want this hook to be able to return an error value. I don't have any objection to such a hook. Others? -- Stephen D. Smalley, NAI Labs ssmalleyat_private _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Wed Feb 06 2002 - 12:26:36 PST