Re: [TOMOYO #11 (linux-next) 01/11] Introduce new LSM hooks where vfsmount is available.

[Shaya Potter <spotter@cs.columbia.edu>]

Shaya Potter wrote:
> crispin@crispincowan.com wrote:
>> Quoting Shaya Potter <spotter@cs.columbia.edu>:
>>> I know I'm late to the game in this, but as I recently asked about this
>>> and didn't get an answer, I'll re-ask my approach.
>>>
>>> Why can't you do this
>>>
>>> in lookup()
>>>
>>> - resolve rules (not for single process, but for all processes) for
>>> said path and tag dentry (seem to already have a hook)
>>>
>>> in permission()
>>
>> Because it doesn't work 
>> http://kerneltrap.org/mailarchive/linux-fsdevel/2007/6/8/319446
>>
>> Quick summary: The difference between the pathname model and the label 
>> model is dynamism. The accessi really is determined by the pathname to 
>> the file that you used to access the file. If you try to compute 
>> access based on attributes tagged onto the file, then you have to 
>> re-compute those attributes every time someone renames a file.
> 
> ok.  simple question then so why not just recompute them every every 
> rename?  are rename's that common relative to all other file operations 
> where we care?

just want to followup as didn't get a response.  If the problem is 
rename(), what's the problem with dropping the label on rename() to 
force a reevaluation on the next pass through the lookup() code.