Re: Out of tree module using LSM

From: Justin Banks <justinb@bakbone.com>
To: Al Viro <viro@ftp.linux.org.uk>
Cc: Justin Banks <justinb@bakbone.com>,
	Alan Cox <alan@lxorguk.ukuu.org.uk>,
	Jon Masters <jonathan@jonmasters.org>,
	Ray Lee <ray-lk@madrabbit.org>,
	tvrtko.ursulin@sophos.com,
	Casey Schaufler <casey@schaufler-ca.com>,
	Christoph Hellwig <hch@infradead.org>,
	linux-kernel@vger.kernel.org, Valdis.Kletnieks@vt.edu
Subject: Re: Out of tree module using LSM
Date: Fri, 30 Nov 2007 08:37:12 -0700	[thread overview]
Message-ID: <20071130153712.GA7959@bleen.domain.actdsltmp> (raw)
In-Reply-To: <20071130014811.GA8181@ftp.linux.org.uk>

Al Viro wrote
> On Thu, Nov 29, 2007 at 03:12:38PM -0700, Justin Banks wrote:
> 
> > It's not perfect, but as was recently pointed out, if you can only get
> > 98% of the way there rather than 100% is that a reason for not trying to
> > make it possible?
> 
> BTW, that's a fine example of a common fallacy: "$FOO is 98% of the way to
> $TARGET" does not allow to interpolate the properties of $TARGET to those
> of $FOO.
> 
> Telling that a condom is a 98% approximation to platonic ideal of such is
> not particulary useful, especially if it turns out that what this number 
> really means is that there's a hole on its tip covering 2% of surface...

Understood, but for this use case (and indexing, probably replication,
IDS, and others) hooking at the "normal" VFS layer would provide enough
flexibility to do what's needed. I'm not saying it should be done, only
that it'd work, provide more use cases for linux, and not be totally
unsupportable.

-justinb

-- 
Justin Banks
BakBone Software
justinb@bakbone.com