From: Steve Dickson <SteveD-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
To: "J. Bruce Fields" <bfields-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Cc: "Myklebust,
Trond" <Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA@public.gmane.org>,
"David P. Quigley"
<dpquigl-+05T5uksL2qpZYMLLGbcSA@public.gmane.org>,
Linux NFS list
<linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
Linux FS devel list
<linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
Linux Security List
<linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
SELinux List <selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org>
Subject: Re: [PATCH 09/17] NFSv4: Introduce new label structure
Date: Wed, 08 May 2013 15:06:41 -0400 [thread overview]
Message-ID: <518AA241.7010700@RedHat.com> (raw)
In-Reply-To: <20130508185635.GB11497-spRCxval1Z7TsXDwO4sDpg@public.gmane.org>
On 08/05/13 14:56, J. Bruce Fields wrote:
> On Wed, May 08, 2013 at 06:06:24PM +0000, Myklebust, Trond wrote:
>> On Wed, 2013-05-08 at 13:32 -0400, Steve Dickson wrote:
>>> Not the label but the inode. The bit is set in ACCESS, LOOKUP,
>>> LINK, OPEN, CREAT, SETATTR which all clearly update the inode.
>>>
>>> So I guess my question is if the bit is not set in any of these
>>> ops how do we know if the label has changed? Should label changes
>>> be synchronized with inode updates?
>>
>> I know that Bruce doesn't like FATTR4_CHANGE_SEC_LABEL,
>
> Not true at all, sorry to give that impression.
>
> It doesn't look like a lot of work to implement (how much work would it
> be to use on the client side?), and I'd be perfectly happy if someone
> would do so.
>
> It's just that noone's volunteered, and my todo list is out of control
> as it is.
>
>> but that is the
>> only option I can see for implementing a cache consistency model for
>> labels. Without it, the choices are:
>>
>> 1) always fetch the label as part of every COMPOUND.
>> 2) assume the label never changes on the server.
>>
>> The main use cases that have been presented for Labeled NFS on Linux
>> would tend to push me towards door number 2, Monty please...
>
> And that's fine with me too.
This being the case... Are you saying setting the label only needs
to be set during the nfs_fhget(), _nfs4_do_open() and nfs4_set_security_label().
Which means the setting of the label will be removed from nfs_refresh_inode()
and all its callers.... correct?
steved.
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2013-05-08 19:06 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-29 12:57 [PATCH 00/17] lnfs: 3.9-rc8 release (take 2) Steve Dickson
2013-04-29 12:57 ` [PATCH 01/17] NFSv4.2: Added v4.2 error codes Steve Dickson
2013-04-29 12:57 ` [PATCH 02/17] NFSv4.2: Added NFS v4.2 support to the NFS client Steve Dickson
2013-04-29 12:57 ` [PATCH 03/17] NFSDv4.2: Added NFS v4.2 support to the NFS server Steve Dickson
2013-05-07 20:44 ` J. Bruce Fields
2013-05-07 20:46 ` J. Bruce Fields
2013-04-29 12:57 ` [PATCH 04/17] Security: Add hook to calculate context based on a negative dentry Steve Dickson
2013-04-29 12:57 ` [PATCH 05/17] Security: Add Hook to test if the particular xattr is part of a MAC model Steve Dickson
2013-04-29 12:57 ` [PATCH 06/17] LSM: Add flags field to security_sb_set_mnt_opts for in kernel mount data Steve Dickson
2013-04-29 12:57 ` [PATCH 07/17] SELinux: Add new labeling type native labels Steve Dickson
2013-04-29 12:57 ` [PATCH 08/17] NFSv4: Add label recommended attribute and NFSv4 flags Steve Dickson
2013-04-29 12:57 ` [PATCH 09/17] NFSv4: Introduce new label structure Steve Dickson
2013-05-01 18:59 ` Myklebust, Trond
2013-05-02 18:31 ` Steve Dickson
[not found] ` <5182B100.2080900-AfCzQyP5zfLQT0dZR+AlfA@public.gmane.org>
2013-05-02 18:39 ` Myklebust, Trond
[not found] ` <1367434764.4189.33.camel-5lNtUQgoD8Pfa3cDbr2K10B+6BGkLq7r@public.gmane.org>
2013-05-08 13:43 ` Steve Dickson
[not found] ` <518A567F.5060405-AfCzQyP5zfLQT0dZR+AlfA@public.gmane.org>
2013-05-08 15:16 ` Casey Schaufler
2013-05-08 17:32 ` Steve Dickson
[not found] ` <518A8C3D.9000407-AfCzQyP5zfLQT0dZR+AlfA@public.gmane.org>
2013-05-08 18:06 ` Myklebust, Trond
2013-05-08 18:56 ` J. Bruce Fields
[not found] ` <20130508185635.GB11497-spRCxval1Z7TsXDwO4sDpg@public.gmane.org>
2013-05-08 19:06 ` Steve Dickson [this message]
2013-04-29 12:57 ` [PATCH 12/17] NFS: Add label lifecycle management Steve Dickson
2013-04-29 12:57 ` [PATCH 13/17] NFS: Client implementation of Labeled-NFS Steve Dickson
2013-05-01 19:03 ` Myklebust, Trond
2013-05-08 16:39 ` Steve Dickson
2013-05-08 16:43 ` Myklebust, Trond
2013-05-08 17:39 ` Steve Dickson
2013-05-08 18:07 ` Myklebust, Trond
2013-05-08 18:27 ` Steve Dickson
2013-05-08 18:31 ` Myklebust, Trond
[not found] ` <1368037873.5978.34.camel-5lNtUQgoD8Pfa3cDbr2K10B+6BGkLq7r@public.gmane.org>
2013-05-08 18:41 ` Steve Dickson
2013-05-08 18:47 ` Myklebust, Trond
2013-04-29 12:57 ` [PATCH 14/17] NFS: Extend NFS xattr handlers to accept the security namespace Steve Dickson
2013-04-29 12:57 ` [PATCH 16/17] NFSD: Server implementation of MAC Labeling Steve Dickson
2013-04-30 15:49 ` J. Bruce Fields
2013-05-06 20:26 ` J. Bruce Fields
[not found] ` <1367240239-19326-1-git-send-email-SteveD-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2013-04-29 12:57 ` [PATCH 10/17] NFSv4: Extend fattr bitmaps to support all 3 words Steve Dickson
2013-04-29 12:57 ` [PATCH 11/17] NFS:Add labels to client function prototypes Steve Dickson
2013-04-29 12:57 ` [PATCH 15/17] Kconfig: Add Kconfig entry for Labeled NFS V4 client Steve Dickson
2013-04-29 12:57 ` [PATCH 17/17] Kconfig: Add Kconfig entry for Labeled NFS V4 server Steve Dickson
2013-04-30 15:57 ` [PATCH 00/17] lnfs: 3.9-rc8 release (take 2) J. Bruce Fields
2013-04-30 16:11 ` Myklebust, Trond
2013-04-30 16:13 ` J. Bruce Fields
[not found] ` <1367338308.4260.18.camel-5lNtUQgoD8Pfa3cDbr2K10B+6BGkLq7r@public.gmane.org>
2013-04-30 17:32 ` Steve Dickson
-- strict thread matches above, loose matches on Subject: below --
2013-05-02 17:18 [PATCH 00/17] lnfs: linux-3.9 release Steve Dickson
2013-05-02 17:19 ` [PATCH 09/17] NFSv4: Introduce new label structure Steve Dickson
2013-04-24 20:17 [PATCH 00/17] lnfs: 3.9-rc8 release Steve Dickson
2013-04-24 20:17 ` [PATCH 09/17] NFSv4: Introduce new label structure Steve Dickson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=518AA241.7010700@RedHat.com \
--to=steved-h+wxahxf7alqt0dzr+alfa@public.gmane.org \
--cc=Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA@public.gmane.org \
--cc=bfields-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=dpquigl-+05T5uksL2qpZYMLLGbcSA@public.gmane.org \
--cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).