From: Gianni Tedesco <gianni@scaramanga.co.uk>
To: Luke Kenneth Casson Leighton <lkcl@lkcl.net>
Cc: linux-kernel@vger.kernel.org
Subject: Re: [patch] to add device+inode check to ipt_owner.c - HACKED UP
Date: Fri, 10 Sep 2004 08:49:28 +0100 [thread overview]
Message-ID: <1094802568.8495.49.camel@sherbert> (raw)
In-Reply-To: <20040908103922.GD9795@lkcl.net>
On Wed, 2004-09-08 at 11:39 +0100, Luke Kenneth Casson Leighton wrote:
> ... did i sent a patch?
>
> did i send a patch?? i don't _think_ so *lol* :)
heh :)
IMO the number of constraints involed here make using this patch fairly
involved (for something security related at least) in that, as you said,
you have to:
- be careful to use ACCEPT rules only
- be careful that you do:
1. remove fw rules
2. upgrade software
3. replace rules
plus the fastpath code looks very hairy with at least 3 locks taken and
O(num_tasks * max_fds) unpreemptable in softirq...
There has to be a simpler approach, perhaps passing in a path, looking
up the dentry in current namespace and setting an unused flag in
d_vfs_flags? That way you could just match on skb->sk->sk_socket->file-
>f_dentry.
I don't know enough about VFS to know if that's really possible. I mean
would you need vfsmnt too to make it accurate across namespaces? and if
so, could dcookie infrastructure be used?
--
// Gianni Tedesco (gianni at scaramanga dot co dot uk)
lynx --source www.scaramanga.co.uk/scaramanga.asc | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D
next prev parent reply other threads:[~2004-09-10 7:49 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-09-08 10:09 [patch] to add device+inode check to ipt_owner.c - HACKED UP Luke Kenneth Casson Leighton
2004-09-08 10:14 ` Arjan van de Ven
2004-09-08 13:43 ` Luke Kenneth Casson Leighton
2004-09-08 10:39 ` Luke Kenneth Casson Leighton
2004-09-08 10:47 ` viro
2004-09-08 13:35 ` Luke Kenneth Casson Leighton
2004-09-10 7:49 ` Gianni Tedesco [this message]
2004-09-10 9:57 ` Luke Kenneth Casson Leighton
2004-09-10 11:11 ` Luke Kenneth Casson Leighton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1094802568.8495.49.camel@sherbert \
--to=gianni@scaramanga.co.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=lkcl@lkcl.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.