Re: [patch] update: _working_ code to add device+inode check to ipt_owner.c

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Thu, Sep 09, 2004 at 12:29:07PM -0400, Stephen Smalley wrote:
> On Thu, 2004-09-09 at 12:22, Luke Kenneth Casson Leighton wrote:
> > 	i do not believe it to be sensible to have the kernel
> > 	code doing that kind of checking (resolving the full
> > 	pathname of an executable) but hey, if anyone feels
> > 	otherwise, and knows of some pre-existing code to point
> > 	me in the direction of, i'll add it, because it might
> > 	be easier in the long run.
> <snip>
> > 	has someone already done this before now, and if so,
> > 	where?
> 
> d_path() will give you a pathname given a (dentry, vfsmount) pair.
 
 GREAT.
 
 thank you, that means i _can_ put full path names into an
 iptables rule, which will make life a lot easier from a userspace
 perspective.  i'm a bit worried about keeping the rules list
 up-to-date if an inode changes.

 fireflier already constructs the full path name of the executable
 in its userspace code, for comparison against its rules.

 _i_ accept the performance penalty (per per-packet) but some
 people won't.... and such people will just have to live with
 per-packet firewall rules (not per-packet per-program).

 [or, and i mention this for the benefit of lkml people,
  to create per-program SE/Linux network policy rules, as
  already described by stephen on sel-ml last week]

 l.