Re: Linux 2.6.6-rc3-mm2 and SELinux support of stacked modules

[Joshua Brindle <jbrindle@snu.edu>]

Stephen Smalley wrote:

>On Sun, 2004-05-09 at 22:38, Valdis.Kletnieks@vt.edu wrote:
>  
>
>>I've attached a patch that does the secondary_ops callback for essentially
>>everything used by either my already-written code, in-progress code, or the
>>BSDJail module.
>>    
>>
>
>A couple of notes regarding your insertion of secondary_ops calls:
>
>1) Joshua Brindle (cc'd) posted a patch to this list earlier to likewise
>add secondary ops for another security module.  There were two points of
>overlap:  inode_permission and file_mmap.  In the case of
>inode_permission, you both inserted the secondary hook call after the
>null mask test (existence test).  Are you sure that you will never want
>to see such calls in a secondary module?  In the case of file_mmap,
>Joshua's diff only calls the secondary module if there is a file struct,
>whereas your diff always calls the secondary module.  The latter offers
>greater flexibility to the secondary module, so I'm inclined to use it,
>but thought I should note it as it means that the secondary module will
>need to test for the null file case and act accordingly.
>
>2) Neither the post_mountroot nor pivotroot hooks are likely to survive
>long term IMHO, so I don't plan on adding them to the SELinux module.
> 
>  
>
It might be a better idea for other modules to call the secondary module 
before the check, I wasn't too concerned about it for the module I was 
working on but it might be an issue for others.

Joshua Brindle

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.