On Thu, 2008-02-28 at 20:00 -0500, Christoph Hellwig wrote:
Possibly I'm missing something, but if I'm implementing a security
module that has any security attribute at all, e.g. capability module
with security.capability, and I see a hook called "get_security_blob" or
"get_security_attr" or the like, I'll implement that hook and return my
attribute there. Which in turn will _break_ the labeled NFS
functionality because it is expecting a MAC label specifically.
The whole point here is that we do not want modules like capability to
return their security attributes here, because this is to support
labeled NFS functionality in support of enforcing MAC.
I don't especially care about the hook name per se, but the interface
(whatever it may be) needs to convey the proper semantics, and the
semantics truly are MAC specific (and should be).
--
Stephen Smalley
National Security Agency
--
