From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] security: move LSM xattrnames to xattr.h Date: Wed, 3 Nov 2010 13:00:31 -0400 Message-ID: <201011031300.31522.sgrubb@redhat.com> References: <1278011263-7951-1-git-send-email-zohar@linux.vnet.ibm.com> <201010120919.11819.sgrubb@redhat.com> <1286890834.2670.21.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: Text/Plain; charset=utf-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: Ozan =?utf-8?q?=C3=87a=C4=9Flayan?= , James Morris , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Casey Schaufler , David Safford , Dave Hansen , Mimi Zohar To: Mimi Zohar Return-path: In-Reply-To: <1286890834.2670.21.camel@localhost.localdomain> Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Tuesday, October 12, 2010 09:40:34 am Mimi Zohar wrote: > On Tue, 2010-10-12 at 09:19 -0400, Steve Grubb wrote: > > On Tuesday, October 12, 2010 09:06:09 am Mimi Zohar wrote: > > > On Tue, 2010-10-12 at 14:14 +0300, Ozan =C3=87a=C4=9Flayan wrote: > > > > Cuma 02 Temmuz 2010 g=C3=BCn=C3=BC (saat 03:16:01) James Morris= =C5=9Funlar=C4=B1 yazm=C4=B1=C5=9Ft=C4=B1: > > > > > On Thu, 1 Jul 2010, Mimi Zohar wrote: > > > > > > Make the security extended attributes names global. Updated= to > > > > > > move the remaining Smack xattrs. > > > > > >=20 > > > > > > Signed-off-by: Mimi Zohar > > > > > > Acked-by: Serge Hallyn > > > >=20 > > > > This drops > > > >=20 > > > > #define XATTR_CAPS_SUFFIX "capability" > > > > #define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX > > > >=20 > > > > definitions from capability.h and puts them in xattr.h's #ifdef > > > > __KERNEL__ section making them invisible to userspace like libc= ap-ng > > > > causing build failures. > > > >=20 > > > > Am I wrong? > > >=20 > > > You're correct. It's the same reason that cap-ng.c has to define > > > 'security'. > > >=20 > > > #ifdef VFS_CAP_U32 > > >=20 > > > #include > > > #define XATTR_SECURITY_PREFIX "security." > > >=20 > > > Am cc'ing Steve. > >=20 > > So does this mean I need to provide more definitions for libcap-ng = to > > work with future kernels or are you asking my opinion? My opinion i= s > > that if user space needs it to work correctly, please let it be > > available so I don't have to make my own define which may be inaccu= rate > > one day. > >=20 > > Thanks, > > -Steve >=20 > Before making any changes to the kernel xattr.h, I want to understand > the reason for two xattr.h files, one in /usr/include/linux/ and the > other in /usr/include/xattr/. /usr/include/linux/xattr.h contains th= ose > elements not defined as __kernel__, while /usr/include/xattr/xattr.h > contains that and other definitions. Will changing the kernel xattr.= h > version change both? >=20 > As long as we're making this change, should 'security' also be define= d > outside of the __kernel__ definitions? I guess no one fixed this before 2.6.36 was finalized. Removing the def= ine has broke user=20 space compilation for anything that works on file based capabilities. I= can define it=20 myself, but if the kernel folks ever change the string, then we have mo= re than just a=20 compile problem, we have runtime problems because I can no longer use t= he correct=20 string. So, what was the gain for breaking user space? -Steve -- To unsubscribe from this list: send the line "unsubscribe linux-securit= y-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html