Hello. Simon Arlott wrote:I think there are two other problems regarding LSM. (1) There is only one "struct security_ops" structure in the system. (2) There is only one "void *security" field in "struct task_struct". Years ago, there was only one MAC implementation (i.e. SELinux) in the mainline kernel. But now, there are many MAC (or access control/tracking) implementations waiting for inclusion into the mainline kernel. The competition for occupying "struct security_ops" has started. My idea is that, why not create chains of "struct security_ops" (i.e. linked list of "struct security_ops") and allow choosing which chain to use for per a "struct task_struct" basis (i.e. add "struct security_ops" to "struct task_struct"). TOMOYO Linux is having difficulty that TOMOYO Linux unlikely be able to use "struct security_ops" since SELinux is occupying it. Yes, there is secondary_ops in SELinux, but it doesn't help TOMOYO Linux since SELinux is not calling secondary ops for operations TOMOYO Linux wants to control. So, there is only one "struct security_ops" as a matter of practice. At the same time, the competition for occupying "void *security" has started. My idea is that, why not allow multiple "void *security" fields in "struct task_struct"? TOMOYO Linux is having difficulty that TOMOYO Linux unlikely be able to use "struct task_struct"->security field since SELinux is occupying it. If TOMOYO Linux is permitted to add "void *" and "u32" to "struct task_struct", SELinux and other LSM implementations can use "struct task_struct"->security field. May be we should consider stackable LSM again? Regards. -
| Alan Cox | [PATCH 01/76] drivers/serial/crisv10.c: add missing put_tty_driver |
| Greg KH | [GIT PATCH] driver core patches against 2.6.24 |
| Adrian Bunk | Re: Linux 2.6.21 |
| David Miller | Slow DOWN, please!!! |
git: | |
| Jon Smirl | Re: VCS comparison table |
| Junio C Hamano | [RFD] On deprecating "git-foo" for builtins |
| Eric Wong | [PATCH] archimport improvements |
| Johannes Schindelin | Re: [FAQ?] Rationale for git's way to manage the index |
| Richard Stallman | Real men don't attack straw men |
| GVG GVG | ssh_exchange_identification: Connection closed by remote host |
| Leon Dippenaar | New tcp stack attack |
| Henning Brauer | Re: About Xen: maybe a reiterative question but .. |
| David Miller | [GIT]: Networking |
| Mark Lord | Re: 2.6.25-rc8: FTP transfer errors |
| Alexey Dobriyan | [PATCH 01/33] nf_conntrack_sip: de-static helper pointers |
| Evgeniy Polyakov | Re: [BUG] New Kernel Bugs |
