From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [AppArmor 32/44] Enable LSM hooks to distinguish operations on file descriptors from operations on pathnames Date: Thu, 28 Jun 2007 12:12:07 -0400 (EDT) Message-ID: References: <20070626230756.519733902@suse.de> <20070626231124.098710828@suse.de> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: Andrew Morton , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Andreas Gruenbacher , Miklos Szeredi To: John Johansen Return-path: In-Reply-To: <20070626231124.098710828@suse.de> Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Tue, 26 Jun 2007, jjohansen@suse.de wrote: > Struct iattr already contains ia_file since commit cc4e69de from > Miklos (which is related to commit befc649c). Use this to pass > struct file down the setattr hooks. This allows LSMs to distinguish > operations on file descriptors from operations on paths. I'm not quite sure I understand this. Why would you distinguish operations based on whether you have a pathname or an inode for an object ? Are you trying to cater for the case where you're holding an open fd for a file which has been deleted, and thus has no pathname? - James -- James Morris