Re: [PATCH] Exporting capability code/name pairs

2007-12-27 Thread James Morris
On Thu, 27 Dec 2007, KaiGai Kohei wrote: (Please put the patch above the .sig separator). + len = strlen(tmp); + + if (ofs = len) + return 0; + + if (len - ofs count) + count = len - ofs; + + rc = copy_to_user(buffer, tmp + ofs, count); +

Re: TOMOYO Linux Security Goal

2007-12-27 Thread Serge E. Hallyn
Quoting Tetsuo Handa ([EMAIL PROTECTED]): Hello. Thank you for feedback. Serge E. Hallyn wrote: TOMOYO Linux is a DIY tool for understanding and protecting your system. TOMOYO Linux policy definitions are absolutely readable to Linux users, and TOMOYO Linux supports unique

Re: POSIX file capabilities for directories

2007-12-27 Thread Serge E. Hallyn
Quoting Andrew Morgan ([EMAIL PROTECTED]): -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: Quoting Chris Friedhoff ([EMAIL PROTECTED]): Hello, in updating the documentation http://www.friedhoff.org/posixfilecaps.html I discovered that it is possible to

Re: TOMOYO Linux Security Goal

2007-12-27 Thread Tetsuo Handa
Hello. Thank you for feedback. Serge E. Hallyn wrote: TOMOYO Linux is a DIY tool for understanding and protecting your system. TOMOYO Linux policy definitions are absolutely readable to Linux users, and TOMOYO Linux supports unique policy learning mechanism which automatically Are they

Re: [PATCH] Exporting capability code/name pairs

2007-12-27 Thread Serge E. Hallyn
Quoting KaiGai Kohei ([EMAIL PROTECTED]): This patch enables to export the code/name pairs of capabilities under /capability of securityfs. In the current libcap, it obtains the list of capabilities from header file on the build environment statically. However, it is not enough portable

Re: POSIX file capabilities for directories

2007-12-27 Thread Jan Engelhardt
On Dec 26 2007 16:29, Andrew Morgan wrote: I'm assuming it's unintended - or rather it's harmless but has no use - but will let Andrew respond since he may have some cool idea i haven't thought of. This is not intended behavior. It should be fixed (aka such support removed). Capabilities

[PATCH 1/1] capabilities: oom_kill: don't set PF_SUPERPRIV for oom check

2007-12-27 Thread Serge E. Hallyn
From ed2e7764917fd56d9743630bd7072f67ff30adc2 Mon Sep 17 00:00:00 2001 From: Serge Hallyn [EMAIL PROTECTED] Date: Wed, 26 Dec 2007 15:04:50 -0800 Subject: [PATCH 1/1] capabilities: oom_kill: don't set PF_SUPERPRIV for oom check With 64-bit capabilities came an inadvertent change such that the

Re: [PATCH] Exporting capability code/name pairs

2007-12-27 Thread KaiGai Kohei
Serge E. Hallyn wrote: Quoting KaiGai Kohei ([EMAIL PROTECTED]): This patch enables to export the code/name pairs of capabilities under /capability of securityfs. In the current libcap, it obtains the list of capabilities from header file on the build environment statically. However, it is not

Re: [PATCH] Exporting capability code/name pairs

2007-12-27 Thread KaiGai Kohei
The attached patch enables to export capability code/name pairs under /capability of securityfs (revision 2). Inprovements from the first revison: - simple_read_from_buffer() is used for read method. - cap_entries[] array is generated from include/linux/capability.h automatically. Remaining

Re: [PATCH] Exporting capability code/name pairs

2007-12-27 Thread James Morris
On Fri, 28 Dec 2007, KaiGai Kohei wrote: + snprintf(tmp, sizeof(tmp), + cap_entry == cap_entries[0] ? 0x%08x : %u, + cap_entry-code); + len = strlen(tmp); You don't need to call strlen(), just use scnprintf() and grab the return value. - James -- James

Re: [PATCH] Exporting capability code/name pairs

2007-12-27 Thread KaiGai Kohei
James Morris wrote: On Fri, 28 Dec 2007, KaiGai Kohei wrote: + snprintf(tmp, sizeof(tmp), +cap_entry == cap_entries[0] ? 0x%08x : %u, +cap_entry-code); + len = strlen(tmp); You don't need to call strlen(), just use scnprintf() and grab the return