From: Ulrich Drepper <drepper@redhat.com>
To: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>, linux-kernel@vger.kernel.org
Subject: Re: [patch 2/3] lsm: add bsdjail module
Date: Tue, 12 Oct 2004 15:35:18 -0700 [thread overview]
Message-ID: <416C5C26.9020403@redhat.com> (raw)
In-Reply-To: <20041012131124.GA2484@IBM-BWN8ZTBWA01.austin.ibm.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Serge E. Hallyn wrote:
> +If a private IP was specified for the jail, then
> + cat /proc/$$/attr/current
How is this going to interact with SELinux? Currently SELinux uses
/proc/*/attr/current to report the current security context of the
process. libselinux expects the file to contain one string (not even a
newline) which is the textual representation of the context. Now with
your changes you want to change this. libselinux as-is would break
miserably.
I don't know the history of the file and who is hijacking the file.
Fact is that the file content is currently unstructured and libselinux
couldn't possibly determine what part is of interest to itself.
So, either you use another file, SELinux uses another file, or the file
gets tagged lines like
selinux: user_u:user_r:user_t
I guess you couldn't even start the userlevel code in FC3 in such a jail
in the moment since the libselinux startup tests would fail.
- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQFBbFwm2ijCOnn/RHQRAvimAJ9W3bIil5Yi1Ex/CX1FpUjzxyheIQCeNKRu
RHv5SGG0iQSEsmbIWfHmwAA=
=HZM3
-----END PGP SIGNATURE-----
next prev parent reply other threads:[~2004-10-12 22:38 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-10-06 20:21 (patch 1/3) lsm: add control over /proc/<pid> visibility Serge Hallyn
2004-10-06 20:24 ` [patch 1/3] lsm: add bsdjail module Serge Hallyn
2004-10-06 23:26 ` Andrew Morton
2004-10-07 4:08 ` Serge E. Hallyn
2004-10-07 6:18 ` James Morris
2004-10-07 6:22 ` Andrew Morton
2004-10-07 16:06 ` Chris Wright
2004-10-07 18:40 ` Andrew Morton
2004-10-07 18:52 ` Chris Wright
2004-10-07 20:56 ` Serge E. Hallyn
2004-10-10 6:24 ` Herbert Poetzl
2004-10-07 12:06 ` Alan Cox
2004-10-07 19:01 ` [patch 2/3] " Serge E. Hallyn
2004-10-07 19:42 ` Chris Wright
2004-10-07 20:05 ` Andrew Morton
2004-10-08 18:05 ` Serge E. Hallyn
2004-10-10 10:41 ` Christoph Hellwig
2004-10-10 11:31 ` Serge E. Hallyn
2004-10-10 11:34 ` Christoph Hellwig
2004-10-11 13:47 ` Alan Cox
2004-10-12 7:00 ` Herbert Poetzl
2004-10-12 9:00 ` Christoph Hellwig
2004-10-12 12:27 ` Herbert Poetzl
2004-10-20 15:36 ` Christoph Hellwig
2004-10-20 19:18 ` Herbert Poetzl
2004-10-12 13:11 ` Serge E. Hallyn
2004-10-12 14:15 ` Christoph Hellwig
2004-10-12 22:35 ` Ulrich Drepper [this message]
2004-10-13 0:58 ` Serge E. Hallyn
2004-10-13 1:09 ` Ulrich Drepper
2004-10-13 1:22 ` Serge E. Hallyn
2004-10-13 15:26 ` Stephen Smalley
2004-10-13 1:11 ` Chris Wright
2004-10-13 14:25 ` Stephen Smalley
2004-10-06 20:25 ` [patch 3/3] lsm: add bsdjail documentation Serge Hallyn
2004-10-07 22:17 ` Matthias Urlichs
2004-10-08 20:02 ` Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=416C5C26.9020403@redhat.com \
--to=drepper@redhat.com \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=serue@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox