Re: [PATCH] Smack: SMACK_IOCLOADACCESS

Alan Cox
2011-08-26T13:15:27Z

> good in that it only takes 1 syscall and ours takes 2. Your interface
> is bad in that it is ioctl and we are told since birth that we must
> hate them no matter what (not that read/write is really any
> different). It isn't the same method the only other LSM I know about
> uses. It can only every return one value (ok, I know ioctl can be
> made to do anything at all)

I'm all in favour of the use of brains rather than the cult of ioctl
hating. You can design bad ioctls and good ones. Also ioctl is pretty
much unique in being bidirectional, it allows a query/respose action
without having to worry about whether the respose is the one to your
query or another parallel query.

Alan