Re: [RFC PATCH 1/2] fs/vfs/security: pass last path component to LSM on inode creation [LWN.net]

From:		Stephen Smalley <stephen.smalley-AT-gmail.com>
To:		Casey Schaufler <casey-AT-schaufler-ca.com>
Subject:		Re: [RFC PATCH 1/2] fs/vfs/security: pass last path component to LSM on inode creation
Date:		Tue, 7 Dec 2010 12:34:59 -0500
Message-ID:		<AANLkTinguKq9A4EwPhpFzv6rYW9EP_XDzJcS+ewXcDsO@mail.gmail.com>
Cc:		Eric Paris <eparis-AT-redhat.com>, penguin-kernel-AT-i-love.sakura.ne.jp, selinux-AT-tycho.nsa.gov, sds-AT-tycho.nsa.gov, jmorris-AT-namei.org, linux-security-module-AT-vger.kernel.org, viro-AT-zeniv.linux.org.uk, hch-AT-lst.de
Archive-link:		Article, Thread

On Tue, Dec 7, 2010 at 11:56 AM, Casey Schaufler <casey@schaufler-ca.com> wrote:
> Let's assume for the moment that no one has a significant objection
> to adding the component name to inode_init_security. I am not
> suggesting that what gets passed to inode_init_security is
> insufficiently general. I am asking if there are other hooks that
> also ought to have the component name as one of their parameters.
> Yes, I understand the concept of "if it ain't broke ...", and that
> may suffice at this point, and if not the fact that no one would be
> using the component name in those other hooks definitely would. I
> expect that when someone comes along with a new LSM that does access
> controls based on the final component* they aren't going to suffer
> unnecessary resistance from the SELinux community as they add the
> component name as a parameter to other hooks.
>
> ----
> * For example, only files suffixed with ".exe" can be executed and
>  only files suffixed with ".so" can be mmapped.

I think you can already achieve that via the pathname hooks, but if
not and you want it, go for it.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

(Log in to post comments)