From: Al Viro <viro@ZenIV.linux.org.uk>
To: Eric Paris <eparis@redhat.com>
Cc: xfs-masters@oss.sgi.com, linux-btrfs@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org,
cluster-devel@redhat.com, linux-mtd@lists.infradead.org,
jfs-discussion@lists.sourceforge.net, ocfs2-devel@oss.oracle.com,
reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com,
linux-mm@kvack.org, linux-security-module@vger.kernel.org,
jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com,
jmorris@namei.org, dhowells@redhat.com, adilger.kernel@dilger.ca,
shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de,
hughd@google.com, joel.becker@oracle.com, chris.mason@oracle.com,
aelder@sgi.com, kees.cook@canonical.com, sds@tycho.nsa.gov,
paul.moore@hp.com, mfasheh@suse.com, dchinner@redhat.com,
eparis@parisplace.org, swhiteho@redhat.com, tao.ma@oracle.com,
tytso@mit.edu, casey@schaufler-ca.com, serue@us.ibm.com,
akpm@linux-foundation.org, dwmw2@infradea
Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation
Date: Fri, 8 Jul 2011 17:17:22 +0100 [thread overview]
Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com>
On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote:
> SELinux would like to implement a new labeling behavior of newly created
> inodes. We currently label new inodes based on the parent and the creating
> process. This new behavior would also take into account the name of the
> new object when deciding the new label. This is not the (supposed) full path,
> just the last component of the path.
>
> This is very useful because creating /etc/shadow is different than creating
> /etc/passwd but the kernel hooks are unable to differentiate these
> operations. We currently require that userspace realize it is doing some
> difficult operation like that and than userspace jumps through SELinux hoops
> to get things set up correctly. This patch does not implement new
> behavior, that is obviously contained in a seperate SELinux patch, but it
> does pass the needed name down to the correct LSM hook. If no such name
> exists it is fine to pass NULL.
-ETOOFUCKINGUGLY...
WARNING: multiple messages have this Message-ID (diff)
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Eric Paris <eparis@redhat.com>
Cc: jfs-discussion@lists.sourceforge.net, jack@suse.cz,
penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com,
joel.becker@oracle.com, dhowells@redhat.com, linux-mm@kvack.org,
linux-mtd@lists.infradead.org, serue@us.ibm.com,
shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de,
hughd@google.com, jmorris@namei.org, cluster-devel@redhat.com,
tao.ma@oracle.com, aelder@sgi.com, kees.cook@canonical.com,
linux-ext4@vger.kernel.org, sds@tycho.nsa.gov, paul.moore@hp.com,
mfasheh@suse.com, reiserfs-devel@vger.kernel.org,
xfs@oss.sgi.com, xfs-masters@oss.sgi.com, dchinner@redhat.com,
eparis@parisplace.org, swhiteho@redhat.com,
chris.mason@oracle.com, tytso@mit.edu,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-btrfs@vger.kernel.org, casey@schaufler-ca.com,
adilger.kernel@dilger.ca, akpm@linux-foundation.org,
dwmw2@infradead.org, ocfs2-devel@oss.oracle.com
Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation
Date: Fri, 8 Jul 2011 17:17:22 +0100 [thread overview]
Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com>
On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote:
> SELinux would like to implement a new labeling behavior of newly created
> inodes. We currently label new inodes based on the parent and the creating
> process. This new behavior would also take into account the name of the
> new object when deciding the new label. This is not the (supposed) full path,
> just the last component of the path.
>
> This is very useful because creating /etc/shadow is different than creating
> /etc/passwd but the kernel hooks are unable to differentiate these
> operations. We currently require that userspace realize it is doing some
> difficult operation like that and than userspace jumps through SELinux hoops
> to get things set up correctly. This patch does not implement new
> behavior, that is obviously contained in a seperate SELinux patch, but it
> does pass the needed name down to the correct LSM hook. If no such name
> exists it is fine to pass NULL.
-ETOOFUCKINGUGLY...
WARNING: multiple messages have this Message-ID (diff)
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Eric Paris <eparis@redhat.com>
Cc: jfs-discussion@lists.sourceforge.net, jack@suse.cz,
jeffm@suse.com, joel.becker@oracle.com, dhowells@redhat.com,
linux-mm@kvack.org, linux-mtd@lists.infradead.org,
serue@us.ibm.com, shaggy@linux.vnet.ibm.com,
shemminger@vyatta.com, hch@lst.de,
penguin-kernel@I-love.SAKURA.ne.jp, hughd@google.com,
jmorris@namei.org, cluster-devel@redhat.com, tao.ma@oracle.com,
aelder@sgi.com, kees.cook@canonical.com,
linux-ext4@vger.kernel.org, sds@tycho.nsa.gov, paul.moore@hp.com,
mfasheh@suse.com, reiserfs-devel@vger.kernel.org,
xfs@oss.sgi.com, xfs-masters@oss.sgi.com, dchinner@redhat.com,
eparis@parisplace.org, swhiteho@redhat.com,
chris.mason@oracle.com, tytso@mit.edu,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-btrfs@vger.kernel.org, casey@schaufler-ca.com,
adilger.kernel@dilger.ca, akpm@linux-foundation.org,
dwmw2@infradead.org, ocfs2-devel@oss.oracle.com
Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation
Date: Fri, 8 Jul 2011 17:17:22 +0100 [thread overview]
Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com>
On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote:
> SELinux would like to implement a new labeling behavior of newly created
> inodes. We currently label new inodes based on the parent and the creating
> process. This new behavior would also take into account the name of the
> new object when deciding the new label. This is not the (supposed) full path,
> just the last component of the path.
>
> This is very useful because creating /etc/shadow is different than creating
> /etc/passwd but the kernel hooks are unable to differentiate these
> operations. We currently require that userspace realize it is doing some
> difficult operation like that and than userspace jumps through SELinux hoops
> to get things set up correctly. This patch does not implement new
> behavior, that is obviously contained in a seperate SELinux patch, but it
> does pass the needed name down to the correct LSM hook. If no such name
> exists it is fine to pass NULL.
-ETOOFUCKINGUGLY...
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
WARNING: multiple messages have this Message-ID (diff)
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Eric Paris <eparis@redhat.com>
Cc: xfs-masters@oss.sgi.com, linux-btrfs@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org,
cluster-devel@redhat.com, linux-mtd@lists.infradead.org,
jfs-discussion@lists.sourceforge.net, ocfs2-devel@oss.oracle.com,
reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com,
linux-mm@kvack.org, linux-security-module@vger.kernel.org,
jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com,
jmorris@namei.org, dhowells@redhat.com, adilger.kernel@dilger.ca,
shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de,
hughd@google.com, joel.becker@oracle.com, chris.mason@oracle.com,
aelder@sgi.com, kees.cook@canonical.com, sds@tycho.nsa.gov,
paul.moore@hp.com, mfasheh@suse.com, dchinner@redhat.com,
eparis@parisplace.org, swhiteho@redhat.com, tao.ma@oracle.com,
tytso@mit.edu, casey@schaufler-ca.com, serue@us.ibm.com,
akpm@linux-foundation.org, dwmw2@infradea
Subject: [Ocfs2-devel] [PATCH] fs/vfs/security: pass last path component to LSM on inode creation
Date: Fri, 08 Jul 2011 16:18:06 -0000 [thread overview]
Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com>
On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote:
> SELinux would like to implement a new labeling behavior of newly created
> inodes. We currently label new inodes based on the parent and the creating
> process. This new behavior would also take into account the name of the
> new object when deciding the new label. This is not the (supposed) full path,
> just the last component of the path.
>
> This is very useful because creating /etc/shadow is different than creating
> /etc/passwd but the kernel hooks are unable to differentiate these
> operations. We currently require that userspace realize it is doing some
> difficult operation like that and than userspace jumps through SELinux hoops
> to get things set up correctly. This patch does not implement new
> behavior, that is obviously contained in a seperate SELinux patch, but it
> does pass the needed name down to the correct LSM hook. If no such name
> exists it is fine to pass NULL.
-ETOOFUCKINGUGLY...
WARNING: multiple messages have this Message-ID (diff)
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Eric Paris <eparis@redhat.com>
Cc: xfs-masters@oss.sgi.com, linux-btrfs@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org,
cluster-devel@redhat.com, linux-mtd@lists.infradead.org,
jfs-discussion@lists.sourceforge.net, ocfs2-devel@oss.oracle.com,
reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com,
linux-mm@kvack.org, linux-security-module@vger.kernel.org,
jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com,
jmorris@namei.org, dhowells@redhat.com, adilger.kernel@dilger.ca,
shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de,
hughd@google.com, joel.becker@oracle.com, chris.mason@oracle.com,
aelder@sgi.com, kees.cook@canonical.com, sds@tycho.nsa.gov,
paul.moore@hp.com, mfasheh@suse.com, dchinner@redhat.com,
eparis@parisplace.org, swhiteho@redhat.com, tao.ma@oracle.com,
tytso@mit.edu, casey@schaufler-ca.com, serue@us.ibm.com,
akpm@linux-foundation.org, dwmw2@infradead.org
Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation
Date: Fri, 8 Jul 2011 17:17:22 +0100 [thread overview]
Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com>
On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote:
> SELinux would like to implement a new labeling behavior of newly created
> inodes. We currently label new inodes based on the parent and the creating
> process. This new behavior would also take into account the name of the
> new object when deciding the new label. This is not the (supposed) full path,
> just the last component of the path.
>
> This is very useful because creating /etc/shadow is different than creating
> /etc/passwd but the kernel hooks are unable to differentiate these
> operations. We currently require that userspace realize it is doing some
> difficult operation like that and than userspace jumps through SELinux hoops
> to get things set up correctly. This patch does not implement new
> behavior, that is obviously contained in a seperate SELinux patch, but it
> does pass the needed name down to the correct LSM hook. If no such name
> exists it is fine to pass NULL.
-ETOOFUCKINGUGLY...
WARNING: multiple messages have this Message-ID (diff)
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Eric Paris <eparis@redhat.com>
Cc: xfs-masters@oss.sgi.com, linux-btrfs@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org,
cluster-devel@redhat.com, linux-mtd@lists.infradead.org,
jfs-discussion@lists.sourceforge.net, ocfs2-devel@oss.oracle.com,
reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com,
linux-mm@kvack.org, linux-security-module@vger.kernel.org,
jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com,
jmorris@namei.org, dhowells@redhat.com, adilger.kernel@dilger.ca,
shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de,
hughd@google.com, joel.becker@oracle.com, chris.mason@oracle.com,
aelder@sgi.com, kees.cook@canonical.com, sds@tycho.nsa.gov,
paul.moore@hp.com, mfasheh@suse.com, dchinner@redhat.com,
eparis@parisplace.org, swhiteho@redhat.com, tao.ma@oracle.com,
tytso@mit.edu, casey@schaufler-ca.com, serue@us.ibm.com,
akpm@linux-foundation.org, dwmw2@infradead.org
Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation
Date: Fri, 8 Jul 2011 17:17:22 +0100 [thread overview]
Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com>
On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote:
> SELinux would like to implement a new labeling behavior of newly created
> inodes. We currently label new inodes based on the parent and the creating
> process. This new behavior would also take into account the name of the
> new object when deciding the new label. This is not the (supposed) full path,
> just the last component of the path.
>
> This is very useful because creating /etc/shadow is different than creating
> /etc/passwd but the kernel hooks are unable to differentiate these
> operations. We currently require that userspace realize it is doing some
> difficult operation like that and than userspace jumps through SELinux hoops
> to get things set up correctly. This patch does not implement new
> behavior, that is obviously contained in a seperate SELinux patch, but it
> does pass the needed name down to the correct LSM hook. If no such name
> exists it is fine to pass NULL.
-ETOOFUCKINGUGLY...
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2011-07-08 16:17 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-12-08 19:45 [PATCH] fs/vfs/security: pass last path component to LSM on inode creation Eric Paris
2011-07-08 16:06 ` [Ocfs2-devel] " Eric Paris
2010-12-08 19:45 ` Eric Paris
2010-12-08 19:45 ` Eric Paris
2010-12-08 19:45 ` Eric Paris
2010-12-08 19:45 ` Eric Paris
2010-12-09 15:05 ` John Stoffel
2010-12-09 15:05 ` John Stoffel
2010-12-09 15:05 ` John Stoffel
2010-12-09 15:05 ` [Ocfs2-devel] " John Stoffel
2010-12-09 15:05 ` John Stoffel
2010-12-09 15:05 ` John Stoffel
2010-12-09 15:52 ` Eric Paris
2010-12-09 15:52 ` Eric Paris
2010-12-09 15:52 ` Eric Paris
2010-12-09 15:52 ` [Ocfs2-devel] " Eric Paris
2010-12-09 15:52 ` Eric Paris
2010-12-09 15:52 ` Eric Paris
2010-12-09 17:48 ` John Stoffel
2010-12-09 17:48 ` John Stoffel
2010-12-09 17:48 ` John Stoffel
2010-12-09 17:48 ` [Ocfs2-devel] " John Stoffel
2010-12-09 17:48 ` John Stoffel
2010-12-09 17:48 ` John Stoffel
2010-12-09 18:05 ` Eric Paris
2010-12-09 18:05 ` Eric Paris
2010-12-09 18:05 ` Eric Paris
2010-12-09 18:05 ` [Ocfs2-devel] " Eric Paris
2010-12-09 18:05 ` Eric Paris
2010-12-09 18:05 ` Eric Paris
2010-12-09 16:05 ` Serge Hallyn
2010-12-09 16:05 ` Serge Hallyn
2010-12-09 16:05 ` Serge Hallyn
2010-12-09 16:05 ` [Ocfs2-devel] " Serge Hallyn
2010-12-09 16:05 ` Serge Hallyn
2010-12-09 16:05 ` Serge Hallyn
2011-07-08 16:17 ` Al Viro [this message]
2011-07-08 16:18 ` [Ocfs2-devel] " Al Viro
2011-07-08 16:17 ` Al Viro
2011-07-08 16:17 ` Al Viro
2011-07-08 16:17 ` Al Viro
2011-07-08 16:17 ` Al Viro
-- strict thread matches above, loose matches on Subject: below --
2010-12-08 19:45 Eric Paris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110708161722.GG11013@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=adilger.kernel@dilger.ca \
--cc=aelder@sgi.com \
--cc=akpm@linux-foundation.org \
--cc=casey@schaufler-ca.com \
--cc=chris.mason@oracle.com \
--cc=cluster-devel@redhat.com \
--cc=dchinner@redhat.com \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradea \
--cc=eparis@parisplace.org \
--cc=eparis@redhat.com \
--cc=hch@lst.de \
--cc=hughd@google.com \
--cc=jack@suse.cz \
--cc=jeffm@suse.com \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=jmorris@namei.org \
--cc=joel.becker@oracle.com \
--cc=kees.cook@canonical.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-mtd@lists.infradead.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mfasheh@suse.com \
--cc=ocfs2-devel@oss.oracle.com \
--cc=paul.moore@hp.com \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=reiserfs-devel@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=serue@us.ibm.com \
--cc=shaggy@linux.vnet.ibm.com \
--cc=shemminger@vyatta.com \
--cc=swhiteho@redhat.com \
--cc=tao.ma@oracle.com \
--cc=tytso@mit.edu \
--cc=xfs-masters@oss.sgi.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.