From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [patch 00/11] mount ownership and unprivileged mount syscall (v9) Date: Wed, 19 Mar 2008 10:04:16 +1100 (EST) Message-ID: References: <20080317200053.447640802@szeredi.hu> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: akpm@linux-foundation.org, hch@infradead.org, serue@us.ibm.com, viro@zeniv.linux.org.uk, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, sds@tycho.nsa.gov, eparis@redhat.com, linux-security-module@vger.kernel.org To: Miklos Szeredi Return-path: In-Reply-To: Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Tue, 18 Mar 2008, Miklos Szeredi wrote: > > We might need a user_mount hook which is called once the core kernel code > > determines that it is a a valid unprivileged mount (although the sb_mount > > hook will already have been called, IIUC). > > Does the order matter between core code's and the security module's > permission checks? Yes, the model is DAC before MAC. > If it does, the cleanest would be to just move the > core checks before the sb_mount hook, no? Correct. -- James Morris