Re: [RFC] [PATCH] [6/6] LSM Stacking: temporary setprocattr hack

[Chris Wright <chrisw@osdl.org>]

* Serge E. Hallyn (serue@us.ibm.com) wrote:
> Quoting Chris Wright (chrisw@osdl.org):
> > * Serge Hallyn (serue@us.ibm.com) wrote:
> > > Stacker assumes that data written to /proc/<pid>/attr/* is of the
> > > form:
> > > 
> > > module_name: data
> > 
> > This breaks current tools where fields are space-delimited.  procps does
> > filtering that way, and I believe libselinux does as well.
> 
> Oh, are you talking about the output of getprocattr?  Perhaps the output
> should (temporarily) be default list the selinux info on the first line,
> without a "selinux: " prepended, and list any other modules after?

Ah, yeah, getprocattr, not the stacker setprocattr, sorry.  For quick
testing, something like that is sufficient.  But for longterm it's got
to be less hackish.

> You mentioned a common LSM sysfs framework.  Does it offer support for
> both per-module and per-pid-per-module files?  If so, then I suppose it
> would be fair to force LSMs to use those, and reserve the existing
> {gs}etprocattr files for selinux use (or nuke them).

Right now it's just per-module files.  The latter adds extra expense per
fork that would be nice to avoid.  Could be a sort of transaction file,
write the pid, get back the assoiciated data, and thus be static with
the directory.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net