Re: Upstream first policy

[Al Viro <viro@ZenIV.linux.org.uk>]

On Mon, Mar 08, 2010 at 06:45:21PM +0000, Al Viro wrote:
> On Mon, Mar 08, 2010 at 10:08:31AM -0800, Linus Torvalds wrote:
> 
> > In other words: it really _does_ make more sense to say "this process has 
> > rights to overwrite the path '/etc/passwd'" than it does to try to label 
> > the file. The _fundamental_ rule is about the pathname. The labeling comes 
> > about BECAUSE YOU USED A HAMMER FOR A SCREW.
> > 
> > I really don't understand why some people are unable to admit this fact. 
> 
> Because you don't have to use that pathname to modify the bits returned
> by read() after open() on that pathname?
> 
> I'm not fond of selinux, to put it mildly, but "pathname-based" stuff simply
> doesn't match how the pathname resolution is defined on Unix...

PS: at that point the *only* things I care about wrt "security" junk are
	* it shouldn't create new assertions to keep for VFS and fs code
	* it shouldn't break the normal Unix permissions for boxen that
sanely have all that crap disabled
	* it shouldn't make one vomit just from RTFS
	* it shouldn't create obvious rootholes when enabled
	* it shouldn't add overhead from hell
	* it shouldn't try to hide the violations of the conditions above

My opinion of the "security community" is worse than yours, BTW.  You have
decided that to let their stuff in; IMO it had been a mistake from the very
beginning, but that's your tree.