* Emily Ratliff (ratliffat_private) wrote: > > The fact that SELinux presently does not use some of the "system" hooks > > should not be taken to mean that we don't consider these hooks to > > be useful. > That is fine. I included the reference to SELinux to point out that I > checked to see if any of the current modules have potentially dangerous > behavior in this area and I was surprise to find none of them actually > using the hooks, esp. given the original design goal of only putting in > hooks that projects are using. I think this is a case where it was clear that CAP_SYS_RAWIO is just insufficient, and the hook felt obvious. > > These "system" hooks can support finer-grained control than the capability > > check. As you note, the iopl and ioperm hooks are architecture-specific > > (even differing in the ia64 case, where ioperm merely calls iopl), but I > > don't think that necessarily means that they should be removed. > I am not necessarily calling for their removal. But, if they stay, I would > just like to see something like the following: I don't mind making a useful note in the interface. On the flip side, is there any better abstraction for mmap'd io? /dev/mem, /dev/kmem, /dev/ports, and /proc/bus/pci all are protected with CAP_SYS_RAWIO. Anyway we can handle this at better granularity? thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Thu Jul 25 2002 - 00:52:45 PDT