From: Christoph Hellwig <hch@infradead.org>
To: "Darrick J. Wong" <darrick.wong@oracle.com>
Cc: Richard Haines <richard_c_haines@btinternet.com>,
sds@tycho.nsa.gov, paul@paul-moore.com,
linux-xfs@vger.kernel.org, selinux@vger.kernel.org
Subject: Re: [PATCH 0/1] selinux: Add xfs quota command types
Date: Thu, 20 Feb 2020 07:59:38 -0800 [thread overview]
Message-ID: <20200220155938.GA1306@infradead.org> (raw)
In-Reply-To: <20200220155731.GU9506@magnolia>
On Thu, Feb 20, 2020 at 07:57:31AM -0800, Darrick J. Wong wrote:
> On Thu, Feb 20, 2020 at 03:32:33PM +0000, Richard Haines wrote:
> > Added these quota command types for SELinux checks on XFS quotas. I picked
> > those I thought useful. The selinux-testsuite will have tests for these
> > permission checks on XFS.
> >
> > One point to note: XFS does not call dquot_quota_on() to trigger
> > security_quota_on(), therefore the 'file quotaon' permission is not tested
> > for SELinux
>
> Is that a feature or a bug? :)
>
> (It sounds like a bug to me, but let's see if anyone complains...)
The dquot_* routines are not generic quota code, but a specific
implementation used by most non-XFS file systems. So if there is a bug
it is that the security call is not in the generic dispatch code.
next prev parent reply other threads:[~2020-02-20 15:59 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-20 15:32 [PATCH 0/1] selinux: Add xfs quota command types Richard Haines
2020-02-20 15:32 ` [PATCH 1/1] " Richard Haines
2020-02-20 15:44 ` Christoph Hellwig
2020-02-22 19:47 ` Paul Moore
2020-02-20 15:57 ` [PATCH 0/1] " Darrick J. Wong
2020-02-20 15:59 ` Christoph Hellwig [this message]
[not found] ` <2862d0b2-e0a9-149d-16e5-22c3f5f82e9e@tycho.nsa.gov>
2020-02-20 16:08 ` Christoph Hellwig
2020-02-22 19:49 ` Paul Moore
2020-02-24 16:41 ` Richard Haines
2020-02-25 4:13 ` Darrick J. Wong
2020-02-25 17:54 ` Richard Haines
2020-02-25 21:35 ` Darrick J. Wong
2020-02-26 15:21 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200220155938.GA1306@infradead.org \
--to=hch@infradead.org \
--cc=darrick.wong@oracle.com \
--cc=linux-xfs@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=richard_c_haines@btinternet.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox