From: Eric Paris <eparis@parisplace.org>
To: Steve Grubb <sgrubb@redhat.com>
Cc: "Mimi Zohar" <zohar@linux.vnet.ibm.com>,
"Ozan Çağlayan" <ozan@pardus.org.tr>,
"James Morris" <jmorris@namei.org>,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-fsdevel@vger.kernel.org,
"Casey Schaufler" <casey@schaufler-ca.com>,
"David Safford" <safford@watson.ibm.com>,
"Dave Hansen" <dave@linux.vnet.ibm.com>,
"Mimi Zohar" <zohar@us.ibm.com>
Subject: Re: [PATCH] security: move LSM xattrnames to xattr.h
Date: Wed, 3 Nov 2010 15:02:11 -0400 [thread overview]
Message-ID: <AANLkTi=MiQsBvdtcr+isqagDYzKOFH0QVb9P=6aAxWVv@mail.gmail.com> (raw)
In-Reply-To: <201011031357.37976.sgrubb@redhat.com>
On Wed, Nov 3, 2010 at 1:57 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Wednesday, November 03, 2010 01:38:33 pm Mimi Zohar wrote:
>> > > As long as we're making this change, should 'security' also be defined
>> > > outside of the __kernel__ definitions?
>> >
>> > I guess no one fixed this before 2.6.36 was finalized. Removing the
>> > define has broke user space compilation for anything that works on file
>> > based capabilities. I can define it myself, but if the kernel folks ever
>> > change the string, then we have more than just a compile problem, we
>> > have runtime problems because I can no longer use the correct string.
>> >
>> > So, what was the gain for breaking user space?
>> >
>> > -Steve
>>
>> Sorry I dropped the ball. Was expecting some kind of response to my
>> question above, and then forgot about it.
>>
>> All of the 'security' xattrs were moved to fsmagic.h, including
>> capability. Not only those that EVM protects, but others like
>> XATTR_NAME_SMACKIPIN/OUT (based on Casey's request).
>
> If user space has to know the exact contents of a string in order to do something that
> the kernel understands, then its part of a public API. I've made my own define and
> released a new copy of libcap-ng. So, if the contents of the string ever change, or
> becomes deprecated, you'll now have user space apps using the old values no matter
> what.
You're right Steve, it is ABI, we broke it, and we can fix it. What
are you having to define and what are you including. What files did
you used to get these defines from?
-Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2010-11-03 19:02 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-07-01 19:07 [PATCH] security: move LSM xattrnames to xattr.h Mimi Zohar
2010-07-02 0:16 ` James Morris
2010-10-12 11:14 ` Ozan Çağlayan
2010-10-12 13:06 ` Mimi Zohar
2010-10-12 13:19 ` Steve Grubb
2010-10-12 13:40 ` Mimi Zohar
2010-11-03 17:00 ` Steve Grubb
2010-11-03 17:38 ` Mimi Zohar
2010-11-03 17:57 ` Steve Grubb
2010-11-03 19:02 ` Eric Paris [this message]
2010-11-03 19:46 ` Steve Grubb
2010-11-03 20:26 ` Eric Paris
2010-11-03 20:45 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='AANLkTi=MiQsBvdtcr+isqagDYzKOFH0QVb9P=6aAxWVv@mail.gmail.com' \
--to=eparis@parisplace.org \
--cc=casey@schaufler-ca.com \
--cc=dave@linux.vnet.ibm.com \
--cc=jmorris@namei.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=ozan@pardus.org.tr \
--cc=safford@watson.ibm.com \
--cc=sgrubb@redhat.com \
--cc=zohar@linux.vnet.ibm.com \
--cc=zohar@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).