Messages in this thread | | | Date | Thu, 06 Aug 2009 14:45:29 -0400 | From | Shaya Potter <> | Subject | Re: security module question |
| |
Eric Paris wrote: > On Wed, 2009-08-05 at 12:02 +1000, James Morris wrote: >> On Tue, 4 Aug 2009, Justin Banks wrote: >> >>> Hello - I'm trying to implement a security module that will allow or >>> disallow writes on files by byte ranges. Is there a way to use >>> inode_permission() to do this, or is there an alternative route I should >>> take? It doesn't look like inode_permission() will give me the data I >>> need (offset + length of write). > > There is nothing that can do that. Neither fanotify nor the LSM. > Biggest problem is mmap..... > > I think there was past kernel module which did this, but I don't > remember what they were called. Nothing which tracks this and could be > used was ever reasonable for the mainline kernel.
stackable file-system could do it (ala ecryptfs). You'd end up with double page table usage (as they don't stack well), but you'd be able to catch all mmap writes to disk.
| |