From: Vivek Goyal <vgoyal@redhat.com>
To: Stephen Smalley <sds@tycho.nsa.gov>
Cc: miklos@szeredi.hu, pmoore@redhat.com, casey@schaufler-ca.com,
linux-kernel@vger.kernel.org, linux-unionfs@vger.kernel.org,
linux-security-module@vger.kernel.org, dwalsh@redhat.com,
dhowells@redhat.com, viro@ZenIV.linux.org.uk,
linux-fsdevel@vger.kernel.org
Subject: Re: [PATCH 3/7] security,overlayfs: Provide security hook for copy up of xattrs for overlay file
Date: Mon, 11 Jul 2016 12:56:59 -0400 [thread overview]
Message-ID: <20160711165659.GC7728@redhat.com> (raw)
In-Reply-To: <2277404e-d91a-7190-ccbd-96e668ea95dd@tycho.nsa.gov>
On Mon, Jul 11, 2016 at 11:31:47AM -0400, Stephen Smalley wrote:
> On 07/08/2016 12:19 PM, Vivek Goyal wrote:
> > Provide a security hook which is called when xattrs of a file are being
> > copied up. This hook is called once for each xattr and LSM can return 0
> > to access the xattr, 1 to reject xattr, -EOPNOTSUPP if none of the lsms
> > claim to know xattr and a negative error code if something went terribly
> > wrong.
>
> 0 if the security module wants the xattr to be copied up, 1 if the
> security module wants the xattr to be discarded on the copy, -EOPNOTSUPP
> if the security module does not handle/manage the xattr, or a -errno
> upon an error.
Ok, will change the description.
>
> >
> > If 0 or -EOPNOTSUPP is returned, xattr will be copied up, if 1 is returned,
> > xattr will not be copied up and if negative error code is returned, copy up
> > will be aborted.
>
> Not sure I understand the benefit of the 0 vs -EOPNOTSUPP distinction.
I am not sure either. Casey wanted to have four states so I introduced it.
Thanks
Vivek
next prev parent reply other threads:[~2016-07-11 16:56 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-08 16:19 [RFC PATCH 0/7][V2] Overlayfs SELinux Support Vivek Goyal
2016-07-08 16:19 ` [PATCH 1/7] security, overlayfs: provide copy up security hook for unioned files Vivek Goyal
2016-07-11 15:24 ` Stephen Smalley
2016-07-11 16:54 ` Vivek Goyal
2016-07-08 16:19 ` [PATCH 2/7] selinux: Implementation for inode_copy_up() hook Vivek Goyal
2016-07-08 16:19 ` [PATCH 3/7] security,overlayfs: Provide security hook for copy up of xattrs for overlay file Vivek Goyal
2016-07-08 17:41 ` kbuild test robot
2016-07-08 17:41 ` kbuild test robot
2016-07-11 13:40 ` Vivek Goyal
2016-07-11 13:50 ` [kbuild-all] [PATCH 3/7] security, overlayfs: " Fengguang Wu
2016-07-12 0:02 ` [PATCH 3/7] security,overlayfs: " Stephen Rothwell
2016-07-11 15:31 ` Stephen Smalley
2016-07-11 16:56 ` Vivek Goyal [this message]
2016-07-11 17:02 ` Vivek Goyal
2016-07-08 16:19 ` [PATCH 4/7] selinux: Implementation for inode_copy_up_xattr() hook Vivek Goyal
2016-07-08 16:19 ` [PATCH 5/7] selinux: Pass security pointer to determine_inode_label() Vivek Goyal
2016-07-08 16:19 ` [PATCH 6/7] security, overlayfs: Provide hook to correctly label newly created files Vivek Goyal
2016-07-08 16:19 ` [PATCH 7/7] selinux: Implement dentry_create_files_as() hook Vivek Goyal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160711165659.GC7728@redhat.com \
--to=vgoyal@redhat.com \
--cc=casey@schaufler-ca.com \
--cc=dhowells@redhat.com \
--cc=dwalsh@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=pmoore@redhat.com \
--cc=sds@tycho.nsa.gov \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.