From: Steve Dickson <SteveD@redhat.com>
To: "J. Bruce Fields" <bfields@redhat.com>
Cc: "Myklebust, Trond" <Trond.Myklebust@netapp.com>,
"David P. Quigley" <dpquigl@tycho.nsa.gov>,
Linux NFS list <linux-nfs@vger.kernel.org>,
Linux FS devel list <linux-fsdevel@vger.kernel.org>,
Linux Security List <linux-security-module@vger.kernel.org>,
SELinux List <selinux@tycho.nsa.gov>
Subject: Re: [PATCH 09/17] NFSv4: Introduce new label structure
Date: Wed, 08 May 2013 15:06:41 -0400 [thread overview]
Message-ID: <518AA241.7010700@RedHat.com> (raw)
In-Reply-To: <20130508185635.GB11497@pad.fieldses.org>
On 08/05/13 14:56, J. Bruce Fields wrote:
> On Wed, May 08, 2013 at 06:06:24PM +0000, Myklebust, Trond wrote:
>> On Wed, 2013-05-08 at 13:32 -0400, Steve Dickson wrote:
>>> Not the label but the inode. The bit is set in ACCESS, LOOKUP,
>>> LINK, OPEN, CREAT, SETATTR which all clearly update the inode.
>>>
>>> So I guess my question is if the bit is not set in any of these
>>> ops how do we know if the label has changed? Should label changes
>>> be synchronized with inode updates?
>>
>> I know that Bruce doesn't like FATTR4_CHANGE_SEC_LABEL,
>
> Not true at all, sorry to give that impression.
>
> It doesn't look like a lot of work to implement (how much work would it
> be to use on the client side?), and I'd be perfectly happy if someone
> would do so.
>
> It's just that noone's volunteered, and my todo list is out of control
> as it is.
>
>> but that is the
>> only option I can see for implementing a cache consistency model for
>> labels. Without it, the choices are:
>>
>> 1) always fetch the label as part of every COMPOUND.
>> 2) assume the label never changes on the server.
>>
>> The main use cases that have been presented for Labeled NFS on Linux
>> would tend to push me towards door number 2, Monty please...
>
> And that's fine with me too.
This being the case... Are you saying setting the label only needs
to be set during the nfs_fhget(), _nfs4_do_open() and nfs4_set_security_label().
Which means the setting of the label will be removed from nfs_refresh_inode()
and all its callers.... correct?
steved.
next prev parent reply other threads:[~2013-05-08 19:06 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-29 12:57 [PATCH 00/17] lnfs: 3.9-rc8 release (take 2) Steve Dickson
2013-04-29 12:57 ` [PATCH 01/17] NFSv4.2: Added v4.2 error codes Steve Dickson
2013-04-29 12:57 ` [PATCH 02/17] NFSv4.2: Added NFS v4.2 support to the NFS client Steve Dickson
2013-04-29 12:57 ` [PATCH 03/17] NFSDv4.2: Added NFS v4.2 support to the NFS server Steve Dickson
2013-05-07 20:44 ` J. Bruce Fields
2013-05-07 20:46 ` J. Bruce Fields
2013-04-29 12:57 ` [PATCH 04/17] Security: Add hook to calculate context based on a negative dentry Steve Dickson
2013-04-29 12:57 ` [PATCH 05/17] Security: Add Hook to test if the particular xattr is part of a MAC model Steve Dickson
2013-04-29 12:57 ` [PATCH 06/17] LSM: Add flags field to security_sb_set_mnt_opts for in kernel mount data Steve Dickson
2013-04-29 12:57 ` [PATCH 07/17] SELinux: Add new labeling type native labels Steve Dickson
2013-04-29 12:57 ` [PATCH 08/17] NFSv4: Add label recommended attribute and NFSv4 flags Steve Dickson
2013-04-29 12:57 ` [PATCH 09/17] NFSv4: Introduce new label structure Steve Dickson
2013-05-01 18:59 ` Myklebust, Trond
2013-05-02 18:31 ` Steve Dickson
2013-05-02 18:39 ` Myklebust, Trond
2013-05-08 13:43 ` Steve Dickson
2013-05-08 15:16 ` Casey Schaufler
2013-05-08 17:32 ` Steve Dickson
2013-05-08 18:06 ` Myklebust, Trond
2013-05-08 18:56 ` J. Bruce Fields
2013-05-08 19:06 ` Steve Dickson [this message]
2013-04-29 12:57 ` [PATCH 10/17] NFSv4: Extend fattr bitmaps to support all 3 words Steve Dickson
2013-04-29 12:57 ` [PATCH 11/17] NFS:Add labels to client function prototypes Steve Dickson
2013-04-29 12:57 ` [PATCH 12/17] NFS: Add label lifecycle management Steve Dickson
2013-04-29 12:57 ` [PATCH 13/17] NFS: Client implementation of Labeled-NFS Steve Dickson
2013-05-01 19:03 ` Myklebust, Trond
2013-05-08 16:39 ` Steve Dickson
2013-05-08 16:43 ` Myklebust, Trond
2013-05-08 17:39 ` Steve Dickson
2013-05-08 18:07 ` Myklebust, Trond
2013-05-08 18:27 ` Steve Dickson
2013-05-08 18:31 ` Myklebust, Trond
2013-05-08 18:41 ` Steve Dickson
2013-05-08 18:47 ` Myklebust, Trond
2013-04-29 12:57 ` [PATCH 14/17] NFS: Extend NFS xattr handlers to accept the security namespace Steve Dickson
2013-04-29 12:57 ` [PATCH 15/17] Kconfig: Add Kconfig entry for Labeled NFS V4 client Steve Dickson
2013-04-29 12:57 ` [PATCH 16/17] NFSD: Server implementation of MAC Labeling Steve Dickson
2013-04-30 15:49 ` J. Bruce Fields
2013-05-06 20:26 ` J. Bruce Fields
2013-04-29 12:57 ` [PATCH 17/17] Kconfig: Add Kconfig entry for Labeled NFS V4 server Steve Dickson
2013-04-30 15:57 ` [PATCH 00/17] lnfs: 3.9-rc8 release (take 2) J. Bruce Fields
2013-04-30 16:11 ` Myklebust, Trond
2013-04-30 16:13 ` J. Bruce Fields
2013-04-30 17:32 ` Steve Dickson
-- strict thread matches above, loose matches on Subject: below --
2013-05-02 17:18 [PATCH 00/17] lnfs: linux-3.9 release Steve Dickson
2013-05-02 17:19 ` [PATCH 09/17] NFSv4: Introduce new label structure Steve Dickson
2013-04-24 20:17 [PATCH 00/17] lnfs: 3.9-rc8 release Steve Dickson
2013-04-24 20:17 ` [PATCH 09/17] NFSv4: Introduce new label structure Steve Dickson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=518AA241.7010700@RedHat.com \
--to=steved@redhat.com \
--cc=Trond.Myklebust@netapp.com \
--cc=bfields@redhat.com \
--cc=dpquigl@tycho.nsa.gov \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).