On Thu, 27 Mar 2003 14:09, Stephen D. Smalley wrote: > > Even just having them in the kernel context would be an improvement over > > the current situation. > > > > We have just had to change polity to allow the init program greater > > access than it would otherwise require because a kernel thread needed > > more access, which is not desirable. > > This can be handled just by changing the selinux_task_reparent_to_init > hook function to use a different SID. Not clear what that SID should > be, e.g. the kernel SID (maps to kernel_t, presently assigned to the > initial task), the kmod SID (maps to kmod_t, formerly assigned for > kernel module loader and hotplug), or a completely new initial SID and > domain. Is kmod_t going away or going to cease being used for modprobe/hotplug? I think that having the lockd thread in question running as kmod_t is not a good idea, it's not what you would expect. kernel_t would be logical choice as a new user would expect such a kernel thread to run in kernel_t. A completely different SID would be OK, but then would we need a series of different SIDs for different kernel threads? -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Thu Mar 27 2003 - 09:53:48 PST