On Sat, Nov 10, 2007 at 01:28:25PM -0800, david@lang.hm wrote:y=20 u=20 =20 Actually no. The unconfined fd being passed in is explicitly different than and fd being passed between two confined processes. In the unconfined parent passing an fd into a confined child the fd isn't reevaluated. In the case of confined parent to confined child the the struct file is reevaluated. As to the implementation issue of revalidation. The path name to file can be found as struct file stores both the vfsmnt and dentry. With that said there are a couple cases where the pathname can't be found. - the file has been deleted - the path has become disconnected. In short under file revalidation deleted file are given a pass and disconnected files fail. For a more in depth explanation look at http://forgeftp.novell.com//apparmor/LKML_Submission-Oct-07/techdoc.pdf regards john
| Tarkan Erimer | Re: Dual-Licensing Linux Kernel with GPL V2 and GPL V3 |
| Greg Kroah-Hartman | [PATCH 005/196] Chinese: add translation of SubmittingDrivers |
| Andrew Morton | Re: -mm merge plans for 2.6.23 -- sys_fallocate |
| Michael Opdenacker | [PATCH] x86: fix unconditional arch/x86/kernel/pcspeaker.c compiling |
git: | |
| David Miller | Re: [GIT]: Networking |
| Gerrit Renker | [PATCH 27/37] dccp: Integration of dynamic feature activation - part 2 (server side) |
| Jarek Poplawski | [PATCH] pkt_sched: Destroy gen estimators under rtnl_lock(). |
| Andrew Morton | Re: [BUG] New Kernel Bugs |
