LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Stephen Smalley <sds@tycho.nsa.gov>
To: casey@schaufler-ca.com
Cc: "Eric W. Biederman" <ebiederm@xmission.com>,
	Andrew Morton <akpm@osdl.org>, Ingo Molnar <mingo@elte.hu>,
	tglx@linutronix.de, linux-kernel@vger.kernel.org,
	selinux@tycho.nsa.gov, jmorris@namei.org
Subject: Re: [PATCH] sysctl selinux: Don't look at table->de
Date: Mon, 29 Jan 2007 15:07:33 -0500	[thread overview]
Message-ID: <1170101253.3294.6.camel@moss-spartans.epoch.ncsc.mil> (raw)
In-Reply-To: <493253.19989.qm@web36606.mail.mud.yahoo.com>

On Mon, 2007-01-29 at 11:08 -0800, Casey Schaufler wrote:
> --- Stephen Smalley <sds@tycho.nsa.gov> wrote:
> 
> > True, but a system that disables proc is likely a
> > system with a custom
> > policy anyway, and dependency on proc is fairly
> > basic to selinux these
> > days (due to reliance on /proc/self/attr for process
> > attribute
> > manipulation in place of the old selinux syscalls). 
> > Possibly we should
> > just make selinux depend on proc and drop the #ifdef
> > there.
> 
> Alternativly you could move the SELinux specific
> bits out of /proc/self/attr into an equivalent
> /selinux/self/attr and avoid that /proc dependency.

We could, but I don't see any compelling reason to do so.  We were
specifically told to use proc for the selinux process attributes when we
refactored the selinux api for 2.6 inclusion, as they are per-process
state and fit naturally into proc.

-- 
Stephen Smalley
National Security Agency


  reply	other threads:[~2007-01-29 20:11 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <200701280106.l0S16CG3019873@shell0.pdx.osdl.net>
     [not found] ` <20070127172410.2b041952.akpm@osdl.org>
     [not found]   ` <1169972718.17469.164.camel@localhost.localdomain>
     [not found]     ` <20070128003549.2ca38dc8.akpm@osdl.org>
     [not found]       ` <20070128093358.GA2071@elte.hu>
     [not found]         ` <20070128095712.GA6485@elte.hu>
     [not found]           ` <20070128100627.GA8416@elte.hu>
     [not found]             ` <20070128104548.a835d859.akpm@osdl.org>
2007-01-28 19:21               ` Eric W. Biederman
2007-01-29 13:04                 ` Stephen Smalley
2007-01-29 15:23                   ` James Morris
2007-01-29 17:55                     ` Eric W. Biederman
2007-01-29 19:26                       ` Stephen Smalley
2007-01-29 17:43                   ` Eric W. Biederman
2007-01-29 18:43                     ` Stephen Smalley
2007-01-29 19:08                       ` Casey Schaufler
2007-01-29 20:07                         ` Stephen Smalley [this message]
2007-01-30 10:25                         ` Christoph Hellwig
2007-01-30 17:19                           ` Casey Schaufler
2007-01-29 19:16                       ` Eric W. Biederman
2007-01-29 23:28                       ` Russell Coker
2007-02-06 21:16                   ` [PATCH 1/2] sysctl: Add a parent entry to ctl_table and set the parent entry Eric W. Biederman
2007-02-06 21:21                     ` [PATCH 2/2] sysctl: Restore the selinux path based label lookup for sysctls Eric W. Biederman
2007-02-07 18:24                       ` Stephen Smalley
2007-02-07 21:12                         ` Stephen Smalley
2007-02-07 21:54                           ` Stephen Smalley
2007-02-07 22:21                             ` Eric W. Biederman
2007-02-08 15:07                               ` Stephen Smalley
2007-02-08  1:57                           ` Eric W. Biederman
2007-02-08 15:01                             ` Stephen Smalley
2007-02-08 17:53                               ` Eric W. Biederman
2007-02-08 18:13                                 ` Stephen Smalley
2007-02-08 22:17                                   ` Eric W. Biederman
2007-02-08 22:51                                     ` [PATCH 0/5] sysctl cleanup selinux fixes Eric W. Biederman
2007-02-08 22:53                                       ` [PATCH 1/5] sysctl: Remove declaration of nonexistent sysctl_init() Eric W. Biederman
2007-02-08 22:54                                         ` [PATCH 2/5] sysctl: Set the parent field in the root sysctl table Eric W. Biederman
2007-02-08 22:55                                           ` [PATCH 3/5] sysctl: Fix the selinux_sysctl_get_sid Eric W. Biederman
2007-02-08 23:02                                             ` [PATCH 4/5] selinux: Enhance selinux to always ignore private inodes Eric W. Biederman
2007-02-08 23:04                                               ` [PATCH 5/5] sysctl: Hide the sysctl proc inodes from selinux Eric W. Biederman
2007-02-09 12:26                                               ` [PATCH 4/5] selinux: Enhance selinux to always ignore private inodes Stephen Smalley
2007-02-09 12:24                                             ` [PATCH 3/5] sysctl: Fix the selinux_sysctl_get_sid Stephen Smalley
2007-02-09 11:05                                       ` [PATCH 0/5] sysctl cleanup selinux fixes Andrew Morton
2007-02-09 18:09                                         ` Eric W. Biederman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1170101253.3294.6.camel@moss-spartans.epoch.ncsc.mil \
    --to=sds@tycho.nsa.gov \
    --cc=akpm@osdl.org \
    --cc=casey@schaufler-ca.com \
    --cc=ebiederm@xmission.com \
    --cc=jmorris@namei.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@elte.hu \
    --cc=selinux@tycho.nsa.gov \
    --cc=tglx@linutronix.de \
    --subject='Re: [PATCH] sysctl selinux: Don'\''t look at table->de' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).