Re: [TOMOYO #11 (linux-next) 01/11] Introduce new LSM hooks wherevfsmount is available.
From: crispin
Date: Mon Oct 20 2008 - 15:41:21 EST
Quoting Shaya Potter <spotter@xxxxxxxxxxxxxxx>:
I know I'm late to the game in this, but as I recently asked about this
and didn't get an answer, I'll re-ask my approach.
Why can't you do this
in lookup()
- resolve rules (not for single process, but for all processes) for
said path and tag dentry (seem to already have a hook)
in permission()
Because it doesn't work
http://kerneltrap.org/mailarchive/linux-fsdevel/2007/6/8/319446
Quick summary: The difference between the pathname model and the label
model is dynamism. The accessi really is determined by the pathname to
the file that you used to access the file. If you try to compute
access based on attributes tagged onto the file, then you have to
re-compute those attributes every time someone renames a file.
Crispin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/