Re: [TOMOYO #11 (linux-next) 01/11] Introduce new LSM hooks wherevfsmount is available.

From: Shaya Potter
Date: Thu Oct 23 2008 - 14:00:53 EST

Shaya Potter wrote:
crispin@xxxxxxxxxxxxxxxx wrote:
Quoting Shaya Potter <spotter@xxxxxxxxxxxxxxx>:
I know I'm late to the game in this, but as I recently asked about this
and didn't get an answer, I'll re-ask my approach.

Why can't you do this

in lookup()

- resolve rules (not for single process, but for all processes) for
said path and tag dentry (seem to already have a hook)

in permission()

Because it doesn't work

Quick summary: The difference between the pathname model and the label model is dynamism. The accessi really is determined by the pathname to the file that you used to access the file. If you try to compute access based on attributes tagged onto the file, then you have to re-compute those attributes every time someone renames a file.

ok. simple question then so why not just recompute them every every rename? are rename's that common relative to all other file operations where we care?

just want to followup as didn't get a response. If the problem is rename(), what's the problem with dropping the label on rename() to force a reevaluation on the next pass through the lookup() code.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at