From: Christoph Hellwig <hch@infradead.org>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: Christoph Hellwig <hch@infradead.org>,
Dave Chinner <david@fromorbit.com>,
linux-xfs@vger.kernel.org, linux-security-module@vger.kernel.org
Subject: Re: [PATCH] [RFC] xfs: initialise attr fork on inode create
Date: Mon, 7 Dec 2020 17:25:45 +0000 [thread overview]
Message-ID: <20201207172545.GA20743@infradead.org> (raw)
In-Reply-To: <f39eb0d7-e437-5dae-303a-bae399e4bada@schaufler-ca.com>
On Mon, Dec 07, 2020 at 09:22:13AM -0800, Casey Schaufler wrote:
> Only security modules should ever look at what's in the security blob.
> In fact, you can't assume that the presence of a security blob
> (i.e. ...->s_security != NULL) implies "need_xattr", or any other
> state for the superblock.
Maybe "strongly suggests that an xattr will be added" is the better
wording.
>
> >> or whether there is some other way of knowing ahead
> >> of time that a security xattr is going to be created. I couldn't
> >> find one, but that doesn't mean such an interface doesn't exist in
> >> all the twisty passages of the LSM layers...
> > I've added the relevant list, maybe someone there has an opinion.
>
> How is what you're looking for different from security_ismaclabel() ?
Not at all. What this needs is a guestimate (which doesn't have
to be 100% reliable) that a new inode created by ->create, ->mknod,
or ->mkdir will have an xattr set on it during the creation syscall.
next prev parent reply other threads:[~2020-12-07 17:26 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-02 23:27 [PATCH] [RFC] xfs: initialise attr fork on inode create Dave Chinner
2020-12-03 8:40 ` Christoph Hellwig
2020-12-03 21:44 ` Dave Chinner
2020-12-04 7:54 ` Christoph Hellwig
2020-12-07 17:22 ` Casey Schaufler
2020-12-07 17:25 ` Christoph Hellwig [this message]
2020-12-07 20:49 ` Dave Chinner
2020-12-04 12:31 ` Brian Foster
2020-12-04 21:22 ` Dave Chinner
2020-12-05 11:34 ` Brian Foster
2020-12-06 23:33 ` Dave Chinner
2020-12-07 16:30 ` Brian Foster
2020-12-07 17:18 ` Darrick J. Wong
2020-12-07 17:12 ` Darrick J. Wong
2020-12-07 17:31 ` Christoph Hellwig
2020-12-07 20:42 ` Dave Chinner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201207172545.GA20743@infradead.org \
--to=hch@infradead.org \
--cc=casey@schaufler-ca.com \
--cc=david@fromorbit.com \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.