Re: object class discovery userland

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

KaiGai Kohei wrote:
> 
> Eamon,
> 
> At first, I want to confirm whether the new selinux_init() intend to
> place userspace AVC on shared memory segment, or not.
> (SE-PostgreSQL has its userspace avc on shared memory segment.)
> 
> When we put userspace AVC on shared memory segment, following points
> should be paid attention.
> 
> - Locking primitive
>   Several processes can refer the userspace AVC on shmem, so inter-processes
>   locking primitive are necessary.
> 
> - Memory allocation
>   Allocating small memory block on shared memory segment is not simple as
>   malloc(). In SE-PostgreSQL case, a fixed length region is assigned by
>   shared memory management subsystem during process initialization.
> 
>   From same reason, we cannot have a mapping table between security context
>   and SID value on the region managed by libselinux, because the total length
>   of security context is not clear when we call selinux_init().
> 
> IMO, Locking callbacks and an option which enables to place userspace AVC
> on given memory region (including fixed length shmem) are desirable.
> 

I think that because of the heavy customization in the Postgres AVC 
implementation it is best kept outside-of-tree at the current time.

There are other applications that use process pools such as Apache and 
if these become hosts to object managers then it may be useful to 
provide a shared memory option in the libselinux version.  The solution 
would involve a flag to the init function, some method of providing the 
shared memory segment to attach to, and special functionality for the 
"manager" process that will listen on netlink.

However, the Postgres implementation is not fully "shared memory" based. 
  The SID-to-context mapping is kept in a "pg_selinux" database table 
which is not stored in shared memory but rather is mapped from disk 
(correct me if I'm wrong).  In the previous thread, the possibility of 
providing callbacks for doing the SID-to-context mapping was discussed. 
  However IMO if this part of the library has to be outsourced to the 
application then the application might as well do the entire AVC.


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.