Re: [Umbrella-devel] Re: Getting full path from dentry in LSM hooks

["Kristian Sørensen" <ks@cs.aau.dk>]

Just forgot something:

Horst von Brand wrote:
>>                                                  furthermore, you could 
>>specify that attachments executed _from_ the emailprogram would not have 
>>access to the network.
> 
> 
> I.e., no child of the email program could access the network, not even to
> answer a message. Sounds restrictive.
You misunderstood this. The restrictions are introduced by a "restricted 
fork", to which you specify the restrictions the mext process should 
have + those inherited from the parent. So if you execute an attachment 
from the thread that views the email, THIS should be restricted from 
e.g. addressbook and network.

Anyway, when you answer a message - in most cases you put the message in 
an "outbox", which the main thread of the mail program sends, when told 
to, and as the main thread is not restricted from the network 
(supprise!) it will succeed in sending the mails.