Re: [PATCH RFC] file capabilities: clear fcaps on inode change

2007-08-04 Thread Serge E. Hallyn
Quoting Andrew Morgan ([EMAIL PROTECTED]): -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: Meanwhile, any chance you would get some time to implement the cap_bset vs fcaps change you wanted? I'd have to look at my checklist to be sure, but I think that, a version

Re: [RFC][PATCH] Simplified mandatory access control kernel implementation

2007-08-04 Thread Joshua Brindle
Casey Schaufler wrote: --- Joshua Brindle [EMAIL PROTECTED] wrote: Casey Schaufler wrote: --- Joshua Brindle [EMAIL PROTECTED] wrote: ... On the guard implementation I'd like to note that assured pipelines are pretty hard to get right. Without object class and create

Re: [PATCH RFC] file capabilities: clear fcaps on inode change

2007-08-04 Thread Andrew Morgan
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: 0. fix the implementation of cap_setpcap. It is supposed to mean 'this process can raise capabilities, outside its permitted set, in _its own_ inheritable set'. A few clarification questions: Process p1 is calling

Re: [RFC][PATCH] Simplified mandatory access control kernel implementation

2007-08-04 Thread Casey Schaufler
--- Joshua Brindle [EMAIL PROTECTED] wrote: Casey Schaufler wrote: --- Joshua Brindle [EMAIL PROTECTED] wrote: Casey Schaufler wrote: --- Joshua Brindle [EMAIL PROTECTED] wrote: ... On the guard implementation I'd like to note that assured pipelines

Re: [PATCH RFC] file capabilities: clear fcaps on inode change

2007-08-04 Thread Serge E. Hallyn
Quoting Andrew Morgan ([EMAIL PROTECTED]): My current working preference is: 0, 3, 1, 2. I don't consider any of them as urgent as getting the inode modification protection fixed. Oops. Right. I'm not sure I'll have a laptop with me tomorow, but I'll try to get a patch out no later than