Re: [RFC] Virtualization steps

[Chris Wright <chrisw@sous-sol.org>]

* Sam Vilain (sam@vilain.net) wrote:
> extern struct security_operations *security_ops; in
> include/linux/security.h is the global I refer to.

OK, I figured that's what you meant.  The top-level ops are similar in
nature to inode_ops in that there's not a real compelling reason to make
them per process.  The process context is (usually) available, and more
importantly, the object whose access is being mediated is readily
available with its security label.

> There is likely to be some contention there between the security folk
> who probably won't like the idea that your security module can be
> different for different processes, and the people who want to provide
> access to security modules on the systems they want to host or consolidate.

I think the current setup would work fine.  It's less likely that we'd
want a separate security module for each container than simply policy
that is container aware.

thanks,
-chris