From: Samir Bellabes <sam@synack.fr>
To: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: davem@davemloft.net, paul.moore@hp.com,
linux-security-module@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: [PATCH] LSM: Add security_socket_post_accept() and security_socket_post_recv_datagram().
Date: Thu, 23 Apr 2009 16:47:22 +0200 [thread overview]
Message-ID: <m2eivjtojp.fsf@ssh.synack.fr> (raw)
In-Reply-To: <200904232300.IIB39542.SHJFLOtFVQFOMO@I-love.SAKURA.ne.jp> (Tetsuo Handa's message of "Thu, 23 Apr 2009 23:00:09 +0900")
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> writes:
> There could be some programs which get confused by accept()/recvmsg() returning
> an error when poll() said "connections are ready" or "datagrams are ready".
> If we find such programs, we can tell TOMOYO to disable filtering for such
> programs.
Hello Tetsuo,
this will introduce a way to bypass the security system (?)
If TOMOYO won't filter such programs, people may add this "poll()"
feature to their code, in order to escape the security system.
I think it's strange for a security system to allow some programs
because of specific code issue, and not because of security reasons.
sam
next prev parent reply other threads:[~2009-04-23 14:47 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-04-14 10:44 [PATCH] LSM: Add security_socket_post_accept() and security_socket_post_recv_datagram() Tetsuo Handa
2009-04-14 22:59 ` Paul Moore
2009-04-15 5:12 ` Tetsuo Handa
2009-04-15 10:51 ` [PATCH 1/2] " Tetsuo Handa
2009-04-15 10:51 ` [PATCH 2/2] tomoyo: Add network access control support Tetsuo Handa
2009-04-16 18:23 ` [PATCH] LSM: Add security_socket_post_accept() and security_socket_post_recv_datagram() Paul Moore
2009-04-18 8:34 ` Tetsuo Handa
2009-04-20 22:22 ` Paul Moore
2009-04-21 10:54 ` Tetsuo Handa
2009-04-21 10:57 ` David Miller
2009-04-21 11:39 ` Tetsuo Handa
2009-04-21 11:40 ` David Miller
2009-04-21 12:26 ` Tetsuo Handa
2009-04-21 12:37 ` David Miller
2009-04-21 12:52 ` [PATCH] LSM: Add security_socket_post_accept() andsecurity_socket_post_recv_datagram() Tetsuo Handa
2009-04-21 13:04 ` David Miller
2009-04-22 0:55 ` [PATCH] LSM: Add security_socket_post_accept() and security_socket_post_recv_datagram() Tetsuo Handa
2009-04-22 1:14 ` David Miller
2009-04-22 1:49 ` Tetsuo Handa
2009-04-22 4:22 ` David Miller
2009-04-22 5:02 ` Tetsuo Handa
2009-04-22 5:07 ` David Miller
2009-04-22 5:38 ` Tetsuo Handa
2009-04-22 5:52 ` David Miller
2009-04-23 14:00 ` Tetsuo Handa
2009-04-23 14:10 ` David Miller
2009-04-23 14:47 ` Samir Bellabes [this message]
2009-04-22 1:52 ` Greg Lindahl
2009-04-22 4:23 ` David Miller
2009-04-22 6:10 ` Greg Lindahl
2009-04-22 6:34 ` David Miller
2009-04-22 6:41 ` Greg Lindahl
2009-04-22 6:46 ` David Miller
2009-04-22 6:54 ` Greg Lindahl
2009-04-22 6:58 ` David Miller
2009-04-22 7:19 ` Tetsuo Handa
2009-04-24 2:07 ` Tetsuo Handa
2009-04-24 4:35 ` David Miller
2009-04-24 4:41 ` David Miller
2009-04-24 4:55 ` Tetsuo Handa
2009-04-24 5:26 ` Tetsuo Handa
2009-04-24 11:40 ` David Miller
2009-04-24 13:57 ` [PATCH] LSM: Add security_socket_post_accept() andsecurity_socket_post_recv_datagram() Tetsuo Handa
2009-04-19 8:03 ` [PATCH v2] LSM: Add security_socket_post_accept() and security_socket_post_recv_datagram() Tetsuo Handa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m2eivjtojp.fsf@ssh.synack.fr \
--to=sam@synack.fr \
--cc=davem@davemloft.net \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=paul.moore@hp.com \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).