From mboxrd@z Thu Jan 1 00:00:00 1970 From: Al Viro Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation Date: Fri, 8 Jul 2011 17:17:22 +0100 Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> References: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: xfs-masters@oss.sgi.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org, cluster-devel@redhat.com, linux-mtd@lists.infradead.org, jfs-discussion@lists.sourceforge.net, ocfs2-devel@oss.oracle.com, reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com, linux-mm@kvack.org, linux-security-module@vger.kernel.org, jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com, jmorris@namei.org, dhowells@redhat.com, adilger.kernel@dilger.ca, shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de, hughd@google.com, joel.becker@oracle.com, chris.mason@oracle.com, aelder@sgi.com, kees.cook@canonical.com, sds@tycho.nsa.gov, paul.moore@hp.com, mfasheh@suse.com, dchinner@redhat.com, eparis@parisplace.org, swhiteho@redhat.com, tao.ma@oracle.com, tytso@mit.edu, casey@schaufler-ca.com, serue@us.ibm.com, akpm@linux-foundation.org, dwmw2@infradea To: Eric Paris Return-path: In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> List-ID: On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote: > SELinux would like to implement a new labeling behavior of newly created > inodes. We currently label new inodes based on the parent and the creating > process. This new behavior would also take into account the name of the > new object when deciding the new label. This is not the (supposed) full path, > just the last component of the path. > > This is very useful because creating /etc/shadow is different than creating > /etc/passwd but the kernel hooks are unable to differentiate these > operations. We currently require that userspace realize it is doing some > difficult operation like that and than userspace jumps through SELinux hoops > to get things set up correctly. This patch does not implement new > behavior, that is obviously contained in a seperate SELinux patch, but it > does pass the needed name down to the correct LSM hook. If no such name > exists it is fine to pass NULL. -ETOOFUCKINGUGLY... From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [2002:c35c:fd02::1] (helo=ZenIV.linux.org.uk) by canuck.infradead.org with esmtps (Exim 4.76 #1 (Red Hat Linux)) id 1QfDke-0004ca-Ni for linux-mtd@lists.infradead.org; Fri, 08 Jul 2011 16:18:02 +0000 Date: Fri, 8 Jul 2011 17:17:22 +0100 From: Al Viro To: Eric Paris Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> References: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> Sender: Al Viro Cc: jfs-discussion@lists.sourceforge.net, jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com, joel.becker@oracle.com, dhowells@redhat.com, linux-mm@kvack.org, linux-mtd@lists.infradead.org, serue@us.ibm.com, shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de, hughd@google.com, jmorris@namei.org, cluster-devel@redhat.com, tao.ma@oracle.com, aelder@sgi.com, kees.cook@canonical.com, linux-ext4@vger.kernel.org, sds@tycho.nsa.gov, paul.moore@hp.com, mfasheh@suse.com, reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com, xfs-masters@oss.sgi.com, dchinner@redhat.com, eparis@parisplace.org, swhiteho@redhat.com, chris.mason@oracle.com, tytso@mit.edu, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-btrfs@vger.kernel.org, casey@schaufler-ca.com, adilger.kernel@dilger.ca, akpm@linux-foundation.org, dwmw2@infradead.org, ocfs2-devel@oss.oracle.com List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote: > SELinux would like to implement a new labeling behavior of newly created > inodes. We currently label new inodes based on the parent and the creating > process. This new behavior would also take into account the name of the > new object when deciding the new label. This is not the (supposed) full path, > just the last component of the path. > > This is very useful because creating /etc/shadow is different than creating > /etc/passwd but the kernel hooks are unable to differentiate these > operations. We currently require that userspace realize it is doing some > difficult operation like that and than userspace jumps through SELinux hoops > to get things set up correctly. This patch does not implement new > behavior, that is obviously contained in a seperate SELinux patch, but it > does pass the needed name down to the correct LSM hook. If no such name > exists it is fine to pass NULL. -ETOOFUCKINGUGLY... From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from cuda.sgi.com (cuda3.sgi.com [192.48.176.15]) by oss.sgi.com (8.14.3/8.14.3/SuSE Linux 0.8) with ESMTP id p68GI2UN253635 for ; Fri, 8 Jul 2011 11:18:02 -0500 Date: Fri, 8 Jul 2011 17:17:22 +0100 From: Al Viro Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> References: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> List-Id: XFS Filesystem from SGI List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: xfs-bounces@oss.sgi.com Errors-To: xfs-bounces@oss.sgi.com To: Eric Paris Cc: jfs-discussion@lists.sourceforge.net, jack@suse.cz, jeffm@suse.com, joel.becker@oracle.com, dhowells@redhat.com, linux-mm@kvack.org, linux-mtd@lists.infradead.org, serue@us.ibm.com, shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de, penguin-kernel@I-love.SAKURA.ne.jp, hughd@google.com, jmorris@namei.org, cluster-devel@redhat.com, tao.ma@oracle.com, aelder@sgi.com, kees.cook@canonical.com, linux-ext4@vger.kernel.org, sds@tycho.nsa.gov, paul.moore@hp.com, mfasheh@suse.com, reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com, xfs-masters@oss.sgi.com, dchinner@redhat.com, eparis@parisplace.org, swhiteho@redhat.com, chris.mason@oracle.com, tytso@mit.edu, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-btrfs@vger.kernel.org, casey@schaufler-ca.com, adilger.kernel@dilger.ca, akpm@linux-foundation.org, dwmw2@infradead.org, ocfs2-devel@oss.oracle.com On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote: > SELinux would like to implement a new labeling behavior of newly created > inodes. We currently label new inodes based on the parent and the creating > process. This new behavior would also take into account the name of the > new object when deciding the new label. This is not the (supposed) full path, > just the last component of the path. > > This is very useful because creating /etc/shadow is different than creating > /etc/passwd but the kernel hooks are unable to differentiate these > operations. We currently require that userspace realize it is doing some > difficult operation like that and than userspace jumps through SELinux hoops > to get things set up correctly. This patch does not implement new > behavior, that is obviously contained in a seperate SELinux patch, but it > does pass the needed name down to the correct LSM hook. If no such name > exists it is fine to pass NULL. -ETOOFUCKINGUGLY... _______________________________________________ xfs mailing list xfs@oss.sgi.com http://oss.sgi.com/mailman/listinfo/xfs From mboxrd@z Thu Jan 1 00:00:00 1970 From: Al Viro Date: Fri, 08 Jul 2011 16:18:06 -0000 Subject: [Ocfs2-devel] [PATCH] fs/vfs/security: pass last path component to LSM on inode creation In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> References: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Eric Paris Cc: xfs-masters@oss.sgi.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org, cluster-devel@redhat.com, linux-mtd@lists.infradead.org, jfs-discussion@lists.sourceforge.net, ocfs2-devel@oss.oracle.com, reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com, linux-mm@kvack.org, linux-security-module@vger.kernel.org, jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com, jmorris@namei.org, dhowells@redhat.com, adilger.kernel@dilger.ca, shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de, hughd@google.com, joel.becker@oracle.com, chris.mason@oracle.com, aelder@sgi.com, kees.cook@canonical.com, sds@tycho.nsa.gov, paul.moore@hp.com, mfasheh@suse.com, dchinner@redhat.com, eparis@parisplace.org, swhiteho@redhat.com, tao.ma@oracle.com, tytso@mit.edu, casey@schaufler-ca.com, serue@us.ibm.com, akpm@linux-foundation.org, dwmw2@infradea On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote: > SELinux would like to implement a new labeling behavior of newly created > inodes. We currently label new inodes based on the parent and the creating > process. This new behavior would also take into account the name of the > new object when deciding the new label. This is not the (supposed) full path, > just the last component of the path. > > This is very useful because creating /etc/shadow is different than creating > /etc/passwd but the kernel hooks are unable to differentiate these > operations. We currently require that userspace realize it is doing some > difficult operation like that and than userspace jumps through SELinux hoops > to get things set up correctly. This patch does not implement new > behavior, that is obviously contained in a seperate SELinux patch, but it > does pass the needed name down to the correct LSM hook. If no such name > exists it is fine to pass NULL. -ETOOFUCKINGUGLY... From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753941Ab1GHQSE (ORCPT ); Fri, 8 Jul 2011 12:18:04 -0400 Received: from zeniv.linux.org.uk ([195.92.253.2]:58554 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753657Ab1GHQR5 (ORCPT ); Fri, 8 Jul 2011 12:17:57 -0400 Date: Fri, 8 Jul 2011 17:17:22 +0100 From: Al Viro To: Eric Paris Cc: xfs-masters@oss.sgi.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org, cluster-devel@redhat.com, linux-mtd@lists.infradead.org, jfs-discussion@lists.sourceforge.net, ocfs2-devel@oss.oracle.com, reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com, linux-mm@kvack.org, linux-security-module@vger.kernel.org, jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com, jmorris@namei.org, dhowells@redhat.com, adilger.kernel@dilger.ca, shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de, hughd@google.com, joel.becker@oracle.com, chris.mason@oracle.com, aelder@sgi.com, kees.cook@canonical.com, sds@tycho.nsa.gov, paul.moore@hp.com, mfasheh@suse.com, dchinner@redhat.com, eparis@parisplace.org, swhiteho@redhat.com, tao.ma@oracle.com, tytso@mit.edu, casey@schaufler-ca.com, serue@us.ibm.com, akpm@linux-foundation.org, dwmw2@infradead.org Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> References: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote: > SELinux would like to implement a new labeling behavior of newly created > inodes. We currently label new inodes based on the parent and the creating > process. This new behavior would also take into account the name of the > new object when deciding the new label. This is not the (supposed) full path, > just the last component of the path. > > This is very useful because creating /etc/shadow is different than creating > /etc/passwd but the kernel hooks are unable to differentiate these > operations. We currently require that userspace realize it is doing some > difficult operation like that and than userspace jumps through SELinux hoops > to get things set up correctly. This patch does not implement new > behavior, that is obviously contained in a seperate SELinux patch, but it > does pass the needed name down to the correct LSM hook. If no such name > exists it is fine to pass NULL. -ETOOFUCKINGUGLY... From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail172.messagelabs.com (mail172.messagelabs.com [216.82.254.3]) by kanga.kvack.org (Postfix) with ESMTP id 2D9629000C2 for ; Fri, 8 Jul 2011 12:18:08 -0400 (EDT) Date: Fri, 8 Jul 2011 17:17:22 +0100 From: Al Viro Subject: Re: [PATCH] fs/vfs/security: pass last path component to LSM on inode creation Message-ID: <20110708161722.GG11013@ZenIV.linux.org.uk> References: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20101208194527.13537.77202.stgit@paris.rdu.redhat.com> Sender: owner-linux-mm@kvack.org List-ID: To: Eric Paris Cc: xfs-masters@oss.sgi.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org, cluster-devel@redhat.com, linux-mtd@lists.infradead.org, jfs-discussion@lists.sourceforge.net, ocfs2-devel@oss.oracle.com, reiserfs-devel@vger.kernel.org, xfs@oss.sgi.com, linux-mm@kvack.org, linux-security-module@vger.kernel.org, jack@suse.cz, penguin-kernel@I-love.SAKURA.ne.jp, jeffm@suse.com, jmorris@namei.org, dhowells@redhat.com, adilger.kernel@dilger.ca, shaggy@linux.vnet.ibm.com, shemminger@vyatta.com, hch@lst.de, hughd@google.com, joel.becker@oracle.com, chris.mason@oracle.com, aelder@sgi.com, kees.cook@canonical.com, sds@tycho.nsa.gov, paul.moore@hp.com, mfasheh@suse.com, dchinner@redhat.com, eparis@parisplace.org, swhiteho@redhat.com, tao.ma@oracle.com, tytso@mit.edu, casey@schaufler-ca.com, serue@us.ibm.com, akpm@linux-foundation.org, dwmw2@infradead.org On Wed, Dec 08, 2010 at 02:45:27PM -0500, Eric Paris wrote: > SELinux would like to implement a new labeling behavior of newly created > inodes. We currently label new inodes based on the parent and the creating > process. This new behavior would also take into account the name of the > new object when deciding the new label. This is not the (supposed) full path, > just the last component of the path. > > This is very useful because creating /etc/shadow is different than creating > /etc/passwd but the kernel hooks are unable to differentiate these > operations. We currently require that userspace realize it is doing some > difficult operation like that and than userspace jumps through SELinux hoops > to get things set up correctly. This patch does not implement new > behavior, that is obviously contained in a seperate SELinux patch, but it > does pass the needed name down to the correct LSM hook. If no such name > exists it is fine to pass NULL. -ETOOFUCKINGUGLY... -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ Don't email: email@kvack.org