Re: [PATCH] devpts xattr support

[Darrel Goeddel <dgoeddel@TrustedCS.com>]

James Morris wrote:
> What other filesystems are likely to need xattr handlers?  It is (now 
> especially) very simple to add them as needed.
> 

All filesystems (and file types) will need that support.  Basically, 
getfilecon should never be unable to retrieve a context for a valid file 
because there actually *is* a context associated with every file, and it 
is being used for access decisions.
Just think if every file had the standard DAC info, but you could only 
see/modify that info on certain filesystems - you may scratch your head 
for a while trying to figure out what is causing access denials.

> I think we should stick with the xattr API, it is "the" way to manage
> extra-inode data under Linux.  Perhaps what we should do instead is fix
> the core xattr code so that it can do what we need it do to.

I'm all for that.  I will play around with a few ideas and see if I can 
come with anything useful.  I'm thinking along the lines of the 
permission call which uses i_op->permission if it exists and falls back 
to vfs_permission if it does not.  Maybe we can create a fallback for 
*xattr...

Thanks everyone for the feedback.

-- 

Darrel Goeddel
Senior Secure Systems Engineer

Trusted Computer Solutions             E: dgoeddel@trustedcs.com
121 West Goose Alley                   V: 217.384.0028 x19
Urbana, IL  61801                      F: 217.384.0288

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.