Re: [PATCH][RFC] Remove kmod_set_label hook

From: Stephen D. Smalley (sdsat_private)
Date: Thu Mar 27 2003 - 05:09:29 PST

  • Next message: Chris Wright: "Re: [PATCH][RFC] Remove kmod_set_label hook"

    > Even just having them in the kernel context would be an improvement over the 
    > current situation.
    > We have just had to change polity to allow the init program greater access 
    > than it would otherwise require because a kernel thread needed more access, 
    > which is not desirable.
    This can be handled just by changing the selinux_task_reparent_to_init
    hook function to use a different SID.  Not clear what that SID should
    be, e.g. the kernel SID (maps to kernel_t, presently assigned to the
    initial task), the kmod SID (maps to kmod_t, formerly assigned for
    kernel module loader and hotplug), or a completely new initial SID and
    Stephen Smalley, NSA
    linux-security-module mailing list

    This archive was generated by hypermail 2b30 : Thu Mar 27 2003 - 05:02:44 PST