Re: [TOMOYO #11 (linux-next) 01/11] Introduce new LSM hooks wherevfsmount is available.

[Shaya Potter]

Shaya Potter wrote:
> crispin@xxxxxxxxxxxxxxxx wrote:
> > Quoting Shaya Potter <spotter@xxxxxxxxxxxxxxx>:
> > > I know I'm late to the game in this, but as I recently asked about this
> > > and didn't get an answer, I'll re-ask my approach.
> > >
> > > Why can't you do this
> > >
> > > in lookup()
> > >
> > > - resolve rules (not for single process, but for all processes) for
> > > said path and tag dentry (seem to already have a hook)
> > >
> > > in permission()
> >
> > Because it doesn't work 
> > http://kerneltrap.org/mailarchive/linux-fsdevel/2007/6/8/319446
> >
> > Quick summary: The difference between the pathname model and the label 
> > model is dynamism. The accessi really is determined by the pathname to 
> > the file that you used to access the file. If you try to compute 
> > access based on attributes tagged onto the file, then you have to 
> > re-compute those attributes every time someone renames a file.
>
> ok.  simple question then so why not just recompute them every every 
> rename?  are rename's that common relative to all other file operations 
> where we care?

just want to followup as didn't get a response.  If the problem is 
rename(), what's the problem with dropping the label on rename() to 
force a reevaluation on the next pass through the lookup() code.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/