Re: [PATCH -v2 1/2] VM/SELinux: require CAP_SYS_RAWIO for allmmap_zero operations

[Christoph Lameter]

On Wed, 22 Jul 2009, James Morris wrote:

> On Tue, 21 Jul 2009, Eric Paris wrote:
>
> >  	error = security_file_mmap(file, reqprot, prot, flags, addr, 0);
> >  	if (error)
> >  		return error;
> > +
> > +	if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO))
> > +		return -EACCES;
> > +
>
> These DAC checks should happen before the LSM hook, in keeping with the
> general design goal of LSM of "DAC before MAC", so that application
> behavior remains as consistent as possible.

Could they be moved out of core code? mmap_min_addr is already a strange
feature. Now we adding something on top of it.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/