Re: [PATCH 2/3] CRED: Split the task security data and move part of it into struct cred

2007-09-26 Thread Stephen Smalley
On Wed, 2007-09-26 at 14:30 +0100, David Howells wrote: Stephen Smalley [EMAIL PROTECTED] wrote: Precisely when to use one identity vs. the other though isn't always clear, and the potential for accidental divergence is also a concern. What should auditing use in audit_filter_rules()

Re: [PATCH 2/3] CRED: Split the task security data and move part of it into struct cred

2007-09-26 Thread Casey Schaufler
--- David Howells [EMAIL PROTECTED] wrote: Stephen Smalley [EMAIL PROTECTED] wrote: Precisely when to use one identity vs. the other though isn't always clear, and the potential for accidental divergence is also a concern. What should auditing use in audit_filter_rules() when dealing

[PATCH 2/3] CRED: Split the task security data and move part of it into struct cred

2007-09-19 Thread David Howells
Move into the cred struct the part of the task security data that defines how a task acts upon an object. The part that defines how something acts upon a task remains attached to the task. For SELinux this requires some of task_security_struct to be split off into cred_security_struct which is

Re: [PATCH 2/3] CRED: Split the task security data and move part of it into struct cred

2007-09-19 Thread Casey Schaufler
--- David Howells [EMAIL PROTECTED] wrote: Move into the cred struct the part of the task security data that defines how a task acts upon an object. The part that defines how something acts upon a task remains attached to the task. This seems to me to be an unnatural and inappropriate

Re: [PATCH 2/3] CRED: Split the task security data and move part of it into struct cred

2007-09-19 Thread David Howells
Casey Schaufler [EMAIL PROTECTED] wrote: Move into the cred struct the part of the task security data that defines how a task acts upon an object. The part that defines how something acts upon a task remains attached to the task. This seems to me to be an unnatural and inappropriate