From mboxrd@z Thu Jan 1 00:00:00 1970 From: Crispin Cowan Subject: Re: [PATCH 2/2] hijack: update task_alloc_security Date: Tue, 27 Nov 2007 21:50:00 -0800 Message-ID: <474D0188.2040600@crispincowan.com> References: <474B78CB.5070607@au1.ibm.com> <474B7A51.3080300@au1.ibm.com> <474BB095.8080302@manicmethod.com> <1196174188.3925.32.camel@moss-spartans.epoch.ncsc.mil> <20071127154356.GA32362@sergelap.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20071127154356.GA32362-6s5zFf/epYLPQpwDFJZrxKsjOiXwFzmk@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Serge E. Hallyn" Cc: containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Joshua Brindle , linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org, menage-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org, Stephen Smalley List-Id: containers.vger.kernel.org Serge E. Hallyn wrote: > Quoting Stephen Smalley (sds-+05T5uksL2qpZYMLLGbcSA@public.gmane.org): > >> I agree with this part - we don't want people to have to choose between >> using containers and using selinux, so if hijack is going to be a >> requirement for effective use of containers, then we need to make them >> work together. >> > Absolutely, we just need to decide how to properly make it work with > selinux. Maybe we check for > > allow (current_domain):(hijacked_process_domain) hijack > type_transition hijacked_process_domain \ > vserver_enter_binary_t:process vserver1_hijack_admin_t; > Is there to be an LSM hook, so that modules can decide on an arbitrary decision of whether to allow a hijack? So that this "do the right SELinux" thing can be generalized for all LSMs to do the right thing. Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin CEO, Mercenary Linux http://mercenarylinux.com/ Itanium. Vista. GPLv3. Complexity at work