Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks

Greg KH
2006-04-19T16:10:52Z

On Wed, Apr 19, 2006 at 12:02:32PM -0400, Stephen Smalley wrote:
> On Wed, 2006-04-19 at 08:44 -0700, Greg KH wrote:
> > On Wed, Apr 19, 2006 at 08:55:56AM -0400, Yuichi Nakamura wrote:
> > > However, path-name based configuration can not be achieved on SELinux in
> > > following cases.
> > > 1) Files on file system that does not support xattr(such as sysfs)
> > > SELinux policy editor handles all files as same on such file systems.
> >
> > Hm, I've thought about this in the past and wonder if we should add
> > xattr support to sysfs. Would it be useful for things like SELinux?
> > The files would not be created with any xattrs, but would be able to
> > have them once they are set. Would that be good enough?
>
> The generic security xattr fallback behavior in the VFS already provides
> us with most of what we need there. The only thing missing is a way to
> preserve the attributes when inodes are evicted and later re-created
> from sysfs_dirent.

Yeah, without that, it's probably pretty useless :)
Take a look at the patch that added support for owner/mode settings, it
shouldn't be that hard to also add xattr support there.

> One of our people was experimenting with a patch to save and restore
> that information, but we are waiting for some of the audit work to
> finalize as that exports some interfaces from SELinux to the rest of
> the kernel that we need.

That sounds fine, thanks for letting me know.

greg k-h