Re: speaking of stacks

[Paul Moore <paul.moore@hp.com>]

On Friday 04 April 2008 8:24:12 am jamal wrote:
> On Thu, 2008-03-04 at 14:18 -0700, David Miller wrote:
> > This whole song and dance here is for SELINUX to set only
> > the policy->security, so that we can pass that back down
> > into the subsequent xfrm_policy_bysel_ctx().
> >
> > The thing to do is to rearrange these security layer hooks
> > so that they take a "struct xfrm_sec_ctx **" instead of
> > a full policy pointer.
> >
> > Then the code would look like:
> >
> > 		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
> > 		struct xfrm_sec_ctx *ctx;
> >
> > 		err = verify_sec_ctx_len(attrs);
> > 		if (err)
> > 			return err;
> >
> > 		if (rt) {
> > 			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
> >
> > 			if ((err = security_xfrm_policy_alloc(&ctx, uctx)))
> > 				return err;
> > 		}
> > 		xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, ctx,
> > 					   delete, &err);
> > 		security_xfrm_policy_free(ctx);
> >
> > And thus the xfrm_policy wouldn't need to be on the stack
> > any longer.
>
> Yes, that would be cleaner than what i did; i will give the
> opportunity to the SELinux folks to take a first crack at it with the
> above approach.
>
> CCing some of the SElinux folks.
> Thanks Dave.

Sorry, I've been stuck under a rock for about the past month. Unless 
somebody is really anxious to do this I'll see if I can whip up an RFC 
patch and get it out either today or early next week.

-- 
paul moore
linux @ hp