From: Linus Torvalds <torvalds@linux-foundation.org>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>,
Mimi Zohar <zohar@us.ibm.com>,
Andrew Morton <akpm@linux-foundation.org>,
Serge Hallyn <serue@us.ibm.com>, James Morris <jmorris@namei.org>,
Al Viro <viro@zeniv.linux.org.uk>,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
David Safford <safford@watson.ibm.com>
Subject: Re: [PATCH] integrity: fix IMA inode leak
Date: Mon, 8 Jun 2009 09:15:00 -0700 (PDT) [thread overview]
Message-ID: <alpine.LFD.2.01.0906080913020.6847@localhost.localdomain> (raw)
In-Reply-To: <1244464135.3277.13.camel@dyn9002018117.watson.ibm.com>
On Mon, 8 Jun 2009, Mimi Zohar wrote:
>
> Today the security calls are synomymous with MAC. If I understand
> correctly, you're suggesting we need to have a single security layer,
> which, depending on the hook, calls either MAC or integrity, or both.
I don't think we need a single security layer per se.
But I do think that we _already_ hide IMA conceptually under the
"security/" subdirectory, and that the VFS layer shouldn't need to care
about whatever internal details.
We should not have generic code end up having to know about all the
details, when we already have a conceptual nesting. It would be much
better for generic code to just have to worry about one security hook that
then encompasses all the models, than having several different hooks for
each detail.
Linus
next prev parent reply other threads:[~2009-06-08 16:15 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-06-06 20:18 [PATCH] integrity: fix IMA inode leak Hugh Dickins
2009-06-06 21:18 ` Linus Torvalds
2009-06-06 21:35 ` Linus Torvalds
2009-06-06 22:29 ` Hugh Dickins
2009-06-07 6:08 ` Mimi Zohar
2009-06-07 23:09 ` Linus Torvalds
2009-06-08 12:28 ` Mimi Zohar
2009-06-08 16:15 ` Linus Torvalds [this message]
2009-06-08 18:44 ` Mimi Zohar
2009-06-08 23:16 ` James Morris
2009-06-09 2:56 ` Mimi Zohar
2009-06-09 3:42 ` Casey Schaufler
2009-06-07 6:07 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LFD.2.01.0906080913020.6847@localhost.localdomain \
--to=torvalds@linux-foundation.org \
--cc=akpm@linux-foundation.org \
--cc=hugh.dickins@tiscali.co.uk \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=safford@watson.ibm.com \
--cc=serue@us.ibm.com \
--cc=viro@zeniv.linux.org.uk \
--cc=zohar@linux.vnet.ibm.com \
--cc=zohar@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox