Yes, this makes sense to me.
> also too coarse-grained; you want to be able to perform a permission
> check based on the process and the inode attributes, not just a
> process-based check.
Of course, good point. I thought I might regret throwing CAP_ into the
picture ;-)
> If the intent of the trusted namespace is for attributes that can be
> managed by superuser processes (this is my impression), then I think it
> would be better to create a separate namespace and handler for security
> modules for clarity. Or at least for MAC modules.
Yes, there was also some mention of the permission issue w.r.t. HSM and
(i vaguely recall) an xattr interface proposed that noted if the request was
internal from the kernel (skip the capable check) or on behalf of user.
If this were carried through, it could suffice, no?
thanks,
-chris
-- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/