Re: [PATCH] Smack: Simplified Mandatory Access Control Kernel

2007-08-12 Thread Jan Engelhardt
On Aug 11 2007 16:22, Casey Schaufler wrote: @@ -0,0 +1,8 @@ +# +# Makefile for the SMACK LSM +# + +obj-$(CONFIG_SECURITY_SMACK) := smack.o + +smack-y := smack_lsm.o smack_access.o smackfs.o smack-objs := Added. I should have added replace it. +/* + * ' \n\0'

Re: [PATCH] Smack: Simplified Mandatory Access Control Kernel

2007-08-12 Thread Casey Schaufler
--- Andi Kleen [EMAIL PROTECTED] wrote: Entries are never deleted, although they can be modified. The modification case still seems racy then. Fair enough. I'll look into real list management. Casey Schaufler [EMAIL PROTECTED] - To unsubscribe from this list: send the line unsubscribe

Re: [PATCH] Smack: Simplified Mandatory Access Control Kernel

2007-08-12 Thread Andi Kleen
On Sun, Aug 12, 2007 at 10:48:05AM -0700, Casey Schaufler wrote: --- Andi Kleen [EMAIL PROTECTED] wrote: Entries are never deleted, although they can be modified. The modification case still seems racy then. Fair enough. I'll look into real list management. You don't necessarily

Re: [PATCH] Smack: Simplified Mandatory Access Control Kernel

2007-08-12 Thread Casey Schaufler
--- Andi Kleen [EMAIL PROTECTED] wrote: On Sun, Aug 12, 2007 at 10:48:05AM -0700, Casey Schaufler wrote: --- Andi Kleen [EMAIL PROTECTED] wrote: Entries are never deleted, although they can be modified. The modification case still seems racy then. Fair enough. I'll look

Re: [PATCH] Smack: Simplified Mandatory Access Control Kernel

2007-08-12 Thread Kyle Moffett
On Aug 12, 2007, at 22:36:15, Joshua Brindle wrote: Kyle Moffett wrote: On Aug 12, 2007, at 15:41:46, Casey Schaufler wrote: Your boolean solution requires more forthought than the Smack rule solution, but I'll give it to you once you've fleshed out your ## lines. How does it require more

Re: [PATCH] Smack: Simplified Mandatory Access Control Kernel

2007-08-12 Thread Casey Schaufler
--- Kyle Moffett [EMAIL PROTECTED] wrote: really big snip If you have no interest in categorizing the SELinux access vectors, then how do you expect to categorize the LSM hooks, which are almost 1-to-1 mapped with the SELinux access vectors? Those that refer to object accesses and