Re: [PATCH] securityfs

[Greg KH <greg@kroah.com>]

On Wed, Jul 06, 2005 at 02:52:47AM -0400, James Morris wrote:
> On Sun, 3 Jul 2005, Greg KH wrote:
> 
> > Good idea.  Here's a patch to do just that (compile tested only...)
> > 
> > Comments?
> 
> Looks promising so far.
> 
> I'm currently porting selinuxfs funtionality to securityfs, although I'm
> not sure if we'll be ok during early initialization.  selinuxfs is
> currently kern_mounted via an initcall.  We may need an initcall
> kern_mount() of securityfs before SELinux kicks in.

Sure, I don't mind moving this if needed.

> Otherwise, it looks like it'll allow SELinux to drop some code.  Generally 
> it will mean that other LSM components won't have to create their own 
> filesystems, and their subdirectories will be hanging off /security (or 
> wherever selinuxfs is mounted), rather than scattered across /

The code creates /sys/kernel/security as a mount point for securityfs.
This will make the LSB people happy that every LSM does not create a new
fs in / :)

> Some of the SELinux code may be useful as part of securityfs later, as 
> well.

That would be fine.

> How about having all API functions which return a pointer be converted to 
> use ERR_PTR() ?
> 
> This will allow errors to be propagated to the calling code.

Good point, will change that.

thanks,

greg k-h