Re: Filesystem Capabilities in 2.6?

[Tom Reinhart]

Hello,

I'be been reading this discussion with interest, but it seems like people 
are missing the obvious.  There's already an infrastructure in 2.5 that is 
perfect for features like this: the LSM.  Consider the advantages:
1) It's filesystem independent, and doesn't bloat the filesystem, VFS, and 
exec code.  Just hook the exec call in an LSM module and twiddle the 
permissions appropriately according to policy.
2) More importantly, this kind of feature isn't really that useful on its 
own, but makes the most sense in the context of overall system security, 
which is exactly what LSM is designed to enable.

I haven't studies the LSM in any detail, but I'm sure the appropriate hooks 
to implement this kind of policy are either available already, or easily 
added.

_________________________________________________________________
Broadband? Dial-up? Get reliable MSN Internet Access. 
http://resourcecenter.msn.com/access/plans/default.asp