From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Date: Wed, 05 Jun 2019 16:56:47 +0000 Subject: Rational model for UID based controls Message-Id: <18357.1559753807@warthog.procyon.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit List-Id: References: <50c2ea19-6ae8-1f42-97ef-ba5c95e40475@schaufler-ca.com> <155966609977.17449.5624614375035334363.stgit@warthog.procyon.org.uk> <20192.1559724094@warthog.procyon.org.uk> In-Reply-To: To: Casey Schaufler Cc: dhowells@redhat.com, Andy Lutomirski , Al Viro , raven@themaw.net, Linux FS Devel , Linux API , linux-block@vger.kernel.org, keyrings@vger.kernel.org, LSM List , LKML Casey Schaufler wrote: > YES! I'm trying to decide if that's fervour or irritation at this point ;-) > And it would be really great if you put some thought into what > a rational model would be for UID based controls, too. I have put some thought into it, but I don't see a single rational model. It depends very much on the situation. In any case, that's what I was referring to when I said I might need to call inode_permission(). But UIDs don't exist for all filesystems, for example, and there are no UIDs on superblocks, mount objects or hardware events. Now, I could see that you ignore UIDs on things like keys and hardware-triggered events, but how does this interact with things like mount watches that see directories that have UIDs? Are you advocating making it such that process B can only see events triggered by process A if they have the same UID, for example? David