From: Christoph Hellwig <hch@infradead.org>
To: "Darrick J. Wong" <darrick.wong@oracle.com>
Cc: Richard Haines <richard_c_haines@btinternet.com>,
sds@tycho.nsa.gov, paul@paul-moore.com,
linux-xfs@vger.kernel.org, selinux@vger.kernel.org
Subject: Re: [PATCH 0/1] selinux: Add xfs quota command types
Date: Thu, 20 Feb 2020 07:59:38 -0800 [thread overview]
Message-ID: <20200220155938.GA1306@infradead.org> (raw)
In-Reply-To: <20200220155731.GU9506@magnolia>
On Thu, Feb 20, 2020 at 07:57:31AM -0800, Darrick J. Wong wrote:
> On Thu, Feb 20, 2020 at 03:32:33PM +0000, Richard Haines wrote:
> > Added these quota command types for SELinux checks on XFS quotas. I picked
> > those I thought useful. The selinux-testsuite will have tests for these
> > permission checks on XFS.
> >
> > One point to note: XFS does not call dquot_quota_on() to trigger
> > security_quota_on(), therefore the 'file quotaon' permission is not tested
> > for SELinux
>
> Is that a feature or a bug? :)
>
> (It sounds like a bug to me, but let's see if anyone complains...)
The dquot_* routines are not generic quota code, but a specific
implementation used by most non-XFS file systems. So if there is a bug
it is that the security call is not in the generic dispatch code.
next prev parent reply other threads:[~2020-02-20 15:59 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-20 15:32 [PATCH 0/1] selinux: Add xfs quota command types Richard Haines
2020-02-20 15:32 ` [PATCH 1/1] " Richard Haines
2020-02-20 15:44 ` Christoph Hellwig
2020-02-22 19:47 ` Paul Moore
2020-02-20 15:57 ` [PATCH 0/1] " Darrick J. Wong
2020-02-20 15:59 ` Christoph Hellwig [this message]
[not found] ` <2862d0b2-e0a9-149d-16e5-22c3f5f82e9e@tycho.nsa.gov>
2020-02-20 16:08 ` Christoph Hellwig
2020-02-22 19:49 ` Paul Moore
2020-02-24 16:41 ` Richard Haines
2020-02-25 4:13 ` Darrick J. Wong
2020-02-25 17:54 ` Richard Haines
2020-02-25 21:35 ` Darrick J. Wong
2020-02-26 15:21 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200220155938.GA1306@infradead.org \
--to=hch@infradead.org \
--cc=darrick.wong@oracle.com \
--cc=linux-xfs@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=richard_c_haines@btinternet.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.