nfsservctl hook in 2.5

From: Chris Wright (chrisat_private)
Date: Thu Apr 11 2002 - 23:56:40 PDT

  • Next message: Stephen Smalley: "Re: nfsservctl hook in 2.5"

    In current 2.5, the sys_nfsservctl has been fundamentally changed.  The
    functionality has been moved to a filesystem called nfsd.  I see three
    options for supporting nfsservctl hooks as we move forward:
    
    1)  Simple hook that only checks the command, not the args (standard
    copy_from_user TOCTTOU race avoided this way).   As the comments in
    the fs/nfsctl.c source suggest, this hook would disappear once this
    functionality treated as a standard filesystem.  The first attachment
    is a rough idea of this approach.
    
    2) Add code to the nfs server module that specifically calls out
    for each command with the args (after copy_from_user).  This directly
    preserves current functionality, but is more invasive in the nfs server.
    The second attachment is a rough idea of this approach.
    
    3) This is a filesystem, remove the nfsservctl hook since we have the
    standard filesystem hooks.  This conceptually preserves our current stance
    which tries to avoid placing filesystem specific hooks.  And reading
    the data passed in the buffers during a file write seems a bit strange.
    Labelling via standard post_lookup is a little tough, since currently
    this is an in kernel fs and it manually populates the dcache.
    
    I bring this up because I think this is an example of how filesystems
    will be more prolific in 2.5+
    
    Thoughts/flames?
    -chris
    
    
    


    _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module



    This archive was generated by hypermail 2b30 : Thu Apr 11 2002 - 23:57:55 PDT