From: Russell Coker <russell@coker.com.au> To: Stephen Smalley <sds@tycho.nsa.gov> Cc: "Eric W. Biederman" <ebiederm@xmission.com>, Andrew Morton <akpm@osdl.org>, Ingo Molnar <mingo@elte.hu>, tglx@linutronix.de, linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov, jmorris@namei.org Subject: Re: [PATCH] sysctl selinux: Don't look at table->de Date: Tue, 30 Jan 2007 10:28:51 +1100 [thread overview] Message-ID: <200701301028.56693.russell@coker.com.au> (raw) In-Reply-To: <1170096231.8720.102.camel@moss-spartans.epoch.ncsc.mil> On Tuesday 30 January 2007 05:43, Stephen Smalley <sds@tycho.nsa.gov> wrote: > True, but a system that disables proc is likely a system with a custom > policy anyway, In practice we have to extensively customise policy long before getting to the non-proc stage of optimising for small hardware. The Familiar distribution (used on the iPaQ) has /proc but needs significant policy changes when compared to a typical Fedora workstation. Not only is there the issue that embedded distributions have different daemons and path names to workstations, but the memory constraints mean that even a modular targeted policy is not as small as you desire. > and dependency on proc is fairly basic to selinux these > days (due to reliance on /proc/self/attr for process attribute > manipulation in place of the old selinux syscalls). Possibly we should > just make selinux depend on proc and drop the #ifdef there. I think that is the correct thing to do. Someone who is prepared to do all the work needed to get a recent SE Linux system operating without /proc will have no problem changing the kernel config scripts and everyone else would be better off not being confused by being offered sets of options that are not viable. -- russell@coker.com.au http://etbe.blogspot.com/ My Blog http://www.coker.com.au/sponsorship.html Sponsoring Free Software development
WARNING: multiple messages have this Message-ID (diff)
From: Russell Coker <russell@coker.com.au> To: Stephen Smalley <sds@tycho.nsa.gov> Cc: "Eric W. Biederman" <ebiederm@xmission.com>, Andrew Morton <akpm@osdl.org>, Ingo Molnar <mingo@elte.hu>, tglx@linutronix.de, linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov, jmorris@namei.org Subject: Re: [PATCH] sysctl selinux: Don't look at table->de Date: Tue, 30 Jan 2007 10:28:51 +1100 [thread overview] Message-ID: <200701301028.56693.russell@coker.com.au> (raw) In-Reply-To: <1170096231.8720.102.camel@moss-spartans.epoch.ncsc.mil> On Tuesday 30 January 2007 05:43, Stephen Smalley <sds@tycho.nsa.gov> wrote: > True, but a system that disables proc is likely a system with a custom > policy anyway, In practice we have to extensively customise policy long before getting to the non-proc stage of optimising for small hardware. The Familiar distribution (used on the iPaQ) has /proc but needs significant policy changes when compared to a typical Fedora workstation. Not only is there the issue that embedded distributions have different daemons and path names to workstations, but the memory constraints mean that even a modular targeted policy is not as small as you desire. > and dependency on proc is fairly basic to selinux these > days (due to reliance on /proc/self/attr for process attribute > manipulation in place of the old selinux syscalls). Possibly we should > just make selinux depend on proc and drop the #ifdef there. I think that is the correct thing to do. Someone who is prepared to do all the work needed to get a recent SE Linux system operating without /proc will have no problem changing the kernel config scripts and everyone else would be better off not being confused by being offered sets of options that are not viable. -- russell@coker.com.au http://etbe.blogspot.com/ My Blog http://www.coker.com.au/sponsorship.html Sponsoring Free Software development -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2007-01-30 8:36 UTC|newest] Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top 2007-01-28 1:05 + clocksource-add-verification-watchdog-helper-fix-3.patch added to -mm tree akpm [not found] ` <20070127172410.2b041952.akpm@osdl.org> [not found] ` <1169972718.17469.164.camel@localhost.localdomain> [not found] ` <20070128003549.2ca38dc8.akpm@osdl.org> [not found] ` <20070128093358.GA2071@elte.hu> [not found] ` <20070128095712.GA6485@elte.hu> [not found] ` <20070128100627.GA8416@elte.hu> [not found] ` <20070128104548.a835d859.akpm@osdl.org> 2007-01-28 19:21 ` [PATCH] sysctl selinux: Don't look at table->de Eric W. Biederman 2007-01-28 19:21 ` Eric W. Biederman 2007-01-29 13:04 ` Stephen Smalley 2007-01-29 13:04 ` Stephen Smalley 2007-01-29 15:23 ` James Morris 2007-01-29 15:23 ` James Morris 2007-01-29 17:55 ` Eric W. Biederman 2007-01-29 17:55 ` Eric W. Biederman 2007-01-29 19:26 ` Stephen Smalley 2007-01-29 19:26 ` Stephen Smalley 2007-01-29 17:43 ` Eric W. Biederman 2007-01-29 17:43 ` Eric W. Biederman 2007-01-29 18:43 ` Stephen Smalley 2007-01-29 18:43 ` Stephen Smalley 2007-01-29 19:08 ` Casey Schaufler 2007-01-29 19:08 ` Casey Schaufler 2007-01-29 20:07 ` Stephen Smalley 2007-01-29 20:07 ` Stephen Smalley 2007-01-30 10:25 ` Christoph Hellwig 2007-01-30 17:19 ` Casey Schaufler 2007-01-30 17:19 ` Casey Schaufler 2007-01-29 19:16 ` Eric W. Biederman 2007-01-29 19:16 ` Eric W. Biederman 2007-01-29 23:28 ` Russell Coker [this message] 2007-01-29 23:28 ` Russell Coker 2007-02-06 21:16 ` [PATCH 1/2] sysctl: Add a parent entry to ctl_table and set the parent entry Eric W. Biederman 2007-02-06 21:16 ` Eric W. Biederman 2007-02-06 21:21 ` [PATCH 2/2] sysctl: Restore the selinux path based label lookup for sysctls Eric W. Biederman 2007-02-06 21:21 ` Eric W. Biederman 2007-02-07 18:24 ` Stephen Smalley 2007-02-07 18:24 ` Stephen Smalley 2007-02-07 21:12 ` Stephen Smalley 2007-02-07 21:12 ` Stephen Smalley 2007-02-07 21:54 ` Stephen Smalley 2007-02-07 21:54 ` Stephen Smalley 2007-02-07 22:21 ` Eric W. Biederman 2007-02-07 22:21 ` Eric W. Biederman 2007-02-08 15:07 ` Stephen Smalley 2007-02-08 15:07 ` Stephen Smalley 2007-02-08 1:57 ` Eric W. Biederman 2007-02-08 1:57 ` Eric W. Biederman 2007-02-08 15:01 ` Stephen Smalley 2007-02-08 15:01 ` Stephen Smalley 2007-02-08 17:53 ` Eric W. Biederman 2007-02-08 17:53 ` Eric W. Biederman 2007-02-08 18:13 ` Stephen Smalley 2007-02-08 18:13 ` Stephen Smalley 2007-02-08 22:17 ` Eric W. Biederman 2007-02-08 22:17 ` Eric W. Biederman 2007-02-08 22:51 ` [PATCH 0/5] sysctl cleanup selinux fixes Eric W. Biederman 2007-02-08 22:51 ` Eric W. Biederman 2007-02-08 22:53 ` [PATCH 1/5] sysctl: Remove declaration of nonexistent sysctl_init() Eric W. Biederman 2007-02-08 22:53 ` Eric W. Biederman 2007-02-08 22:54 ` [PATCH 2/5] sysctl: Set the parent field in the root sysctl table Eric W. Biederman 2007-02-08 22:54 ` Eric W. Biederman 2007-02-08 22:55 ` [PATCH 3/5] sysctl: Fix the selinux_sysctl_get_sid Eric W. Biederman 2007-02-08 22:55 ` Eric W. Biederman 2007-02-08 23:02 ` [PATCH 4/5] selinux: Enhance selinux to always ignore private inodes Eric W. Biederman 2007-02-08 23:02 ` Eric W. Biederman 2007-02-08 23:04 ` [PATCH 5/5] sysctl: Hide the sysctl proc inodes from selinux Eric W. Biederman 2007-02-08 23:04 ` Eric W. Biederman 2007-02-09 12:26 ` [PATCH 4/5] selinux: Enhance selinux to always ignore private inodes Stephen Smalley 2007-02-09 12:26 ` Stephen Smalley 2007-02-09 12:24 ` [PATCH 3/5] sysctl: Fix the selinux_sysctl_get_sid Stephen Smalley 2007-02-09 12:24 ` Stephen Smalley 2007-02-09 11:05 ` [PATCH 0/5] sysctl cleanup selinux fixes Andrew Morton 2007-02-09 18:09 ` Eric W. Biederman 2007-02-09 18:09 ` Eric W. Biederman
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=200701301028.56693.russell@coker.com.au \ --to=russell@coker.com.au \ --cc=akpm@osdl.org \ --cc=ebiederm@xmission.com \ --cc=jmorris@namei.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mingo@elte.hu \ --cc=sds@tycho.nsa.gov \ --cc=selinux@tycho.nsa.gov \ --cc=tglx@linutronix.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.