About ACL for IPC Object
in [Kernel]
|
From: zhou peng on 23 Mar 2010 05:10 Hi, I have added ACL support to POSIX msg queue on linux kernel 2.6.32. Casey Schaufler, would you or anyone like review the patch for me please? The patch is attached. Best, 2010/1/21 Casey Schaufler <casey(a)schaufler-ca.com>: > zhou peng wrote: >> Hi all, >> >> There are ACL in file system, but why there are no ACL implementation >> in IPC object, eg. shm, message queue, FIFO? >> > > Most people haven't noticed that IPC objects are even there, much less > that they have mode bits and not ACLs. Even when we were doing security > evaluations on Unix boxes in the 1990's they were considered insufficiently > interesting to justify the additional work to do ACLs. > > If you really want ACLs on IPC objects it would make a dandy little > project for a summer. I would be happy to review patches. > >> Is there any fine grained granting in ipc object just like in file object? >> > > As Stephen Smalley points out, you can do it with SELinux, although > that it rather like driving a thumbtack with a bulldozer. > >> Thanks, >> Best >> >> -- >> zhoupeng >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in >> the body of a message to majordomo(a)vger.kernel.org >> More majordomo info at http://vger.kernel.org/majordomo-info.html >> Please read the FAQ at http://www.tux.org/lkml/ >> >> >> > > -- zhoupeng
From: Christoph Hellwig on 23 Mar 2010 08:00 On Tue, Mar 23, 2010 at 05:01:31PM +0800, zhou peng wrote: > Hi, > > I have added ACL support to POSIX msg queue on linux kernel 2.6.32. > Casey Schaufler, would you or anyone like review the patch for me please? > The patch is attached. There is quite a lot of boilerplate code in the patch. You might want to take a look at fs/generic_acl.c and how mm/shmem.c uses it to get away with a lot less code. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Casey Schaufler on 23 Mar 2010 20:20 zhou peng wrote: > Hi, > > I have added ACL support to POSIX msg queue on linux kernel 2.6.32. > Casey Schaufler, would you or anyone like review the patch for me please? > I didn't see anything horribly wrong, but I have not tested it. Christoph's comments should be heeded. > The patch is attached. > Please include patches inline. It is much easier to make specific comments that way and it is The Way We Do Things. > Best, > > 2010/1/21 Casey Schaufler <casey(a)schaufler-ca.com>: > >> zhou peng wrote: >> >>> Hi all, >>> >>> There are ACL in file system, but why there are no ACL implementation >>> in IPC object, eg. shm, message queue, FIFO? >>> >>> >> Most people haven't noticed that IPC objects are even there, much less >> that they have mode bits and not ACLs. Even when we were doing security >> evaluations on Unix boxes in the 1990's they were considered insufficiently >> interesting to justify the additional work to do ACLs. >> >> If you really want ACLs on IPC objects it would make a dandy little >> project for a summer. I would be happy to review patches. >> >> >>> Is there any fine grained granting in ipc object just like in file object? >>> >>> >> As Stephen Smalley points out, you can do it with SELinux, although >> that it rather like driving a thumbtack with a bulldozer. >> >> >>> Thanks, >>> Best >>> >>> -- >>> zhoupeng >>> -- >>> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in >>> the body of a message to majordomo(a)vger.kernel.org >>> More majordomo info at http://vger.kernel.org/majordomo-info.html >>> Please read the FAQ at http://www.tux.org/lkml/ >>> >>> >>> >>> >> > > > > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|
Pages: 1 Prev: staging: winbond: wb35reg_s.h Coding styls fixes. Next: x86: use lmb to replace early_res |