From: Shaya Potter <spotter@cs.columbia.edu>
To: Eric Paris <eparis@redhat.com>
Cc: James Morris <jmorris@namei.org>,
Justin Banks <justinb@bakbone.com>,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: security module question
Date: Thu, 06 Aug 2009 14:45:29 -0400 [thread overview]
Message-ID: <4A7B24C9.6020309@cs.columbia.edu> (raw)
In-Reply-To: <1249583888.20644.37.camel@dhcp231-106.rdu.redhat.com>
Eric Paris wrote:
> On Wed, 2009-08-05 at 12:02 +1000, James Morris wrote:
>> On Tue, 4 Aug 2009, Justin Banks wrote:
>>
>>> Hello - I'm trying to implement a security module that will allow or
>>> disallow writes on files by byte ranges. Is there a way to use
>>> inode_permission() to do this, or is there an alternative route I should
>>> take? It doesn't look like inode_permission() will give me the data I
>>> need (offset + length of write).
>
> There is nothing that can do that. Neither fanotify nor the LSM.
> Biggest problem is mmap.....
>
> I think there was past kernel module which did this, but I don't
> remember what they were called. Nothing which tracks this and could be
> used was ever reasonable for the mainline kernel.
stackable file-system could do it (ala ecryptfs). You'd end up with
double page table usage (as they don't stack well), but you'd be able to
catch all mmap writes to disk.
prev parent reply other threads:[~2009-08-06 18:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-08-04 22:06 Justin Banks
2009-08-05 2:02 ` James Morris
2009-08-06 18:38 ` Eric Paris
2009-08-06 18:45 ` Shaya Potter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4A7B24C9.6020309@cs.columbia.edu \
--to=spotter@cs.columbia.edu \
--cc=eparis@redhat.com \
--cc=jmorris@namei.org \
--cc=justinb@bakbone.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®