Messages in this thread | | | Date | Mon, 8 Dec 2003 10:26:59 -0800 | From | Chris Wright <> | Subject | Re: PROBLEM: A Capability LSM Module serious bug |
| |
* Serge E. Hallyn (hallyn@CS.WM.EDU) wrote: > The main question is do we declare cap_effective to belong solely to > capability.c, or do we want capability.c to trust previous LSM's > computations of those values? So, even with the current case, if we > insmod, rmmod, then re-insmod capability, do we want to revoke all > previous cap_* computations?
This is a common issue with the opaque blobs as well.
> It seems reasonable for it "belong" to capability.c (and I've heard of > noone else wanting to use it). I just don't think we've explicitly > declared this to be the case.
Unfortunately, it's currently used by kernel proper. So we need a generic solution.
thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |