Re: graft_tree/attach_mnt rfc

From: Mike Wray (mike_wrayat_private)
Date: Mon Sep 30 2002 - 01:19:29 PDT

  • Next message: Serge E. Hallyn: "Re: graft_tree/attach_mnt rfc"

    ----- Original Message ----- 
    From: "Chris Wright" <chrisat_private>
    To: "Serge E. Hallyn" <hallyn@mpi-cbg.de>
    Cc: <linux-security-moduleat_private>
    Sent: Monday, September 30, 2002 8:37 AM
    Subject: Re: graft_tree/attach_mnt rfc
    
    
    > * Serge E. Hallyn (hallyn@mpi-cbg.de) wrote:
    > ...
    > > Do people feel this is worth doing?
    > 
    > I do think it is worth doing.  I guess it comes down to which namespace
    > operations you (and others) need to mediate and how.  do_kern_mount
    > hooks is clearly sufficient for SELinux, and gives each superblock a
    > label.  Is attaching a tree to the namespace something that needs to be
    > mediated, or simply recorded?
    > 
    
    Anyone using a security policy that derives inode security
    information from the namespace needs to follow additions and removals
    in the namespace, not just references to superblocks.
    We do it that way for one.
    
    Mike Wray
    
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Mon Sep 30 2002 - 01:23:39 PDT