From: David Howells <dhowells@redhat.com>
To: James Morris <jmorris@namei.org>
Cc: dhowells@redhat.com, Casey Schaufler <casey@schaufler-ca.com>,
torvalds@osdl.org, akpm@osdl.org, steved@redhat.com,
trond.myklebust@fys.uio.no, linux-fsdevel@vger.kernel.org,
linux-cachefs@redhat.com, nfsv4@linux-nfs.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 11/14] CacheFiles: Permit an inode's security ID to be obtained [try #2]
Date: Thu, 09 Aug 2007 20:07:39 +0100 [thread overview]
Message-ID: <22259.1186686459@redhat.com> (raw)
In-Reply-To: <Pine.LNX.4.64.0708091143440.19611@us.intercode.com.au>
James Morris <jmorris@namei.org> wrote:
> David, I've looked at the code and can't see that you need to access the
> label itself outside the LSM. Could you instead simply pass the inode
> pointer around?
It's not quite that simple. I need to impose *two* security labels in
cachefiles_begin_secure() when I'm about to act on behalf of a process that's
tried to access a netfs file:
(1) The security label to act as. This is the label attached to the
cachefilesd process when it starts the cache. This is obtained by
cachefiles_get_security_ID().
(2) The security label to create files as. This is the label attached to
root directory of the cache. This is obtained by
cachefiles_determine_cache_secid().
David
WARNING: multiple messages have this Message-ID (diff)
From: David Howells <dhowells@redhat.com>
To: James Morris <jmorris@namei.org>
Cc: akpm@osdl.org, linux-kernel@vger.kernel.org, nfsv4@linux-nfs.org,
trond.myklebust@fys.uio.no, linux-fsdevel@vger.kernel.org,
torvalds@osdl.org, linux-cachefs@redhat.com,
Casey Schaufler <casey@schaufler-ca.com>
Subject: Re: [PATCH 11/14] CacheFiles: Permit an inode's security ID to be obtained [try #2]
Date: Thu, 09 Aug 2007 20:07:39 +0100 [thread overview]
Message-ID: <22259.1186686459@redhat.com> (raw)
In-Reply-To: <Pine.LNX.4.64.0708091143440.19611@us.intercode.com.au>
James Morris <jmorris@namei.org> wrote:
> David, I've looked at the code and can't see that you need to access the
> label itself outside the LSM. Could you instead simply pass the inode
> pointer around?
It's not quite that simple. I need to impose *two* security labels in
cachefiles_begin_secure() when I'm about to act on behalf of a process that's
tried to access a netfs file:
(1) The security label to act as. This is the label attached to the
cachefilesd process when it starts the cache. This is obtained by
cachefiles_get_security_ID().
(2) The security label to create files as. This is the label attached to
root directory of the cache. This is obtained by
cachefiles_determine_cache_secid().
David
next prev parent reply other threads:[~2007-08-09 19:08 UTC|newest]
Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-08-09 16:04 [Linux-cachefs] [PATCH 00/14] Permit filesystem local caching [try #2] David Howells
2007-08-09 16:04 ` David Howells
2007-08-09 16:04 ` [Linux-cachefs] [PATCH 01/14] FS-Cache: Release page->private after failed readahead " David Howells
2007-08-09 16:04 ` David Howells
2007-08-09 16:04 ` [Linux-cachefs] [PATCH 02/14] FS-Cache: Recruit a couple of page flags for cache management " David Howells
2007-08-09 16:04 ` David Howells
2007-08-09 16:04 ` [Linux-cachefs] [PATCH 03/14] FS-Cache: Provide an add_wait_queue_tail() function " David Howells
2007-08-09 16:04 ` David Howells
2007-08-09 16:04 ` [PATCH 04/14] FS-Cache: Generic filesystem caching facility " David Howells
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 05/14] CacheFiles: Add missing copy_page export for ia64 " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 06/14] CacheFiles: Add a hook to write a single page of data to an inode " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 07/14] CacheFiles: Permit the page lock state to be monitored " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 08/14] CacheFiles: Export things for CacheFiles " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 09/14] CacheFiles: Permit a process's create SID to be overridden " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 17:04 ` Casey Schaufler
2007-08-09 17:04 ` Casey Schaufler
2007-08-09 18:07 ` David Howells
2007-08-09 18:07 ` David Howells
2007-08-09 18:07 ` David Howells
2007-08-09 18:51 ` Casey Schaufler
2007-08-09 18:51 ` Casey Schaufler
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 10/14] CacheFiles: Add an act-as SID override in task_security_struct " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 11/14] CacheFiles: Permit an inode's security ID to be obtained " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 17:07 ` Casey Schaufler
2007-08-09 17:07 ` Casey Schaufler
2007-08-09 17:22 ` Stephen Smalley
2007-08-09 17:22 ` Stephen Smalley
2007-08-09 17:22 ` Stephen Smalley
2007-08-09 17:59 ` Casey Schaufler
2007-08-09 18:06 ` David Howells
2007-08-09 18:06 ` David Howells
2007-08-09 18:06 ` David Howells
2007-08-09 18:50 ` James Morris
2007-08-09 18:50 ` James Morris
2007-08-09 19:07 ` David Howells [this message]
2007-08-09 19:07 ` David Howells
2007-08-09 19:34 ` James Morris
2007-08-09 19:34 ` James Morris
2007-08-09 20:33 ` Casey Schaufler
2007-08-09 20:33 ` Casey Schaufler
2007-08-10 9:22 ` David Howells
2007-08-10 9:22 ` David Howells
2007-08-09 18:16 ` James Morris
2007-08-09 18:16 ` James Morris
2007-08-09 18:21 ` David Howells
2007-08-09 18:21 ` David Howells
2007-08-09 18:42 ` James Morris
2007-08-09 18:42 ` James Morris
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 12/14] CacheFiles: Get the SID under which the CacheFiles module should operate " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 16:05 ` [PATCH 13/14] CacheFiles: A cache that backs onto a mounted filesystem " David Howells
2007-08-09 16:05 ` [Linux-cachefs] [PATCH 14/14] NFS: Use local caching " David Howells
2007-08-09 16:05 ` David Howells
2007-08-09 18:24 ` Trond Myklebust
2007-08-09 18:24 ` Trond Myklebust
2007-08-09 18:52 ` David Howells
2007-08-09 18:52 ` David Howells
2007-08-09 19:15 ` David Howells
2007-08-09 19:15 ` David Howells
2007-08-09 19:25 ` Trond Myklebust
2007-08-09 19:25 ` Trond Myklebust
2007-08-10 14:04 ` David Howells
2007-08-10 14:04 ` David Howells
2007-08-10 16:07 ` Trond Myklebust
2007-08-10 16:07 ` Trond Myklebust
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=22259.1186686459@redhat.com \
--to=dhowells@redhat.com \
--cc=akpm@osdl.org \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=linux-cachefs@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nfsv4@linux-nfs.org \
--cc=steved@redhat.com \
--cc=torvalds@osdl.org \
--cc=trond.myklebust@fys.uio.no \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.