From: Kentaro Takeda <takedakn@nttdata.co.jp>
To: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, haradats@nttdata.co.jp,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
Al Viro <viro@ZenIV.linux.org.uk>
Subject: Re: [TOMOYO #9 (2.6.27-rc7-mm1) 1/6] LSM adapter functions.
Date: Wed, 01 Oct 2008 17:19:58 +0900 [thread overview]
Message-ID: <48E332AE.7050001@nttdata.co.jp> (raw)
In-Reply-To: <20080930162321.GA31779@us.ibm.com>
Serge E. Hallyn wrote:
>> harmless application/library probing that would be denied by DAC anyway.
>> Same issue would seemingly apply for learning modes of TOMOYO or
>> AppArmor.
> Good point. Kentaro, is that an issue for you?
Indeed, since learning mode of TOMOYO is inherently the same feature
as auditing, it is affected by noise. But it doesn't matter so much.
The main problem is the difference of error code between DAC and MAC.
DAC errors such as ENOENT or EROFS should be returned to callers
first so that callers will not be surprised by MAC errors such as
EPERM.
Regards,
next prev parent reply other threads:[~2008-10-01 8:20 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-24 9:03 [TOMOYO #9 (2.6.27-rc7-mm1) 0/6] TOMOYO Linux Kentaro Takeda
2008-09-24 9:03 ` [TOMOYO #9 (2.6.27-rc7-mm1) 1/6] LSM adapter functions Kentaro Takeda
2008-09-25 16:59 ` Serge E. Hallyn
2008-09-26 5:38 ` Kentaro Takeda
2008-09-26 13:04 ` Serge E. Hallyn
2008-09-29 4:04 ` Kentaro Takeda
2008-09-30 15:45 ` Serge E. Hallyn
2008-09-30 16:14 ` Stephen Smalley
2008-09-30 16:23 ` Serge E. Hallyn
2008-10-01 8:19 ` Kentaro Takeda [this message]
2008-10-01 2:33 ` Casey Schaufler
2008-10-01 5:05 ` Valdis.Kletnieks
2008-10-01 8:23 ` Kentaro Takeda
2008-10-01 21:15 ` Serge E. Hallyn
2008-10-02 5:04 ` Kentaro Takeda
2008-10-02 13:39 ` Serge E. Hallyn
2008-10-03 6:37 ` Kentaro Takeda
2008-10-03 13:09 ` Serge E. Hallyn
2008-10-06 2:19 ` Kentaro Takeda
2008-10-06 16:54 ` Serge E. Hallyn
2008-10-07 6:28 ` Kentaro Takeda
2008-09-24 9:03 ` [TOMOYO #9 (2.6.27-rc7-mm1) 2/6] Memory and pathname management functions Kentaro Takeda
2008-09-24 9:03 ` [TOMOYO #9 (2.6.27-rc7-mm1) 3/6] Common functions for TOMOYO Linux Kentaro Takeda
2008-09-24 9:03 ` [TOMOYO #9 (2.6.27-rc7-mm1) 4/6] Domain transition handler Kentaro Takeda
2008-09-24 9:03 ` [TOMOYO #9 (2.6.27-rc7-mm1) 5/6] File operation restriction part Kentaro Takeda
2008-09-24 9:03 ` [TOMOYO #9 (2.6.27-rc7-mm1) 6/6] Kconfig and Makefile Kentaro Takeda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=48E332AE.7050001@nttdata.co.jp \
--to=takedakn@nttdata.co.jp \
--cc=haradats@nttdata.co.jp \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=serue@us.ibm.com \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox