From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [PATCH 01/11] Security: Add hook to get full maclabel xattr name Date: Fri, 29 Feb 2008 13:15:16 +1100 (EST) Message-ID: References: <519499.69572.qm@web36614.mail.mud.yahoo.com> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: Dave Quigley , Christoph Hellwig , Stephen Smalley , viro@ftp.linux.org.uk, trond.myklebust@fys.uio.no, bfields@fieldses.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, LSM List To: Casey Schaufler Return-path: Received: from namei.org ([69.55.235.186]:41242 "EHLO us.intercode.com.au" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753368AbYB2CPw (ORCPT ); Thu, 28 Feb 2008 21:15:52 -0500 In-Reply-To: <519499.69572.qm@web36614.mail.mud.yahoo.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Thu, 28 Feb 2008, Casey Schaufler wrote: > Easier may be pragmatic, but that does not make it right. > I suggest, that in my opinion (there, is that sufficiently > non-confrontational?) that Linux and the LSM are much better > served by a general xattr protocol than by adding a single > reccommended attribute. An xattr protocol is overkill for conveying a MAC label over the network, and would still not provide the required semantics. Please see prior discussion on this e.g. http://marc.info/?l=linux-kernel&m=120424789929258&w=2 Note that RAs are already used to convey ACLs and all other system-managed metatdata. i.e. an extensible, appropriate infrastructure already exists in the NFSv4 protocol, and has been used successfully for similar purposes. We do not need to add a new, generalized protocol to NFSv4 for this, especially one which does not meet the requirements. - James -- James Morris