From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
To: jmorris@namei.org
Cc: akpm@linux-foundation.org, linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [TOMOYO #14 (mmotm 2008-12-30-16-05) 03/10] Introduce d_realpath().
Date: Wed, 14 Jan 2009 17:58:14 +0900 [thread overview]
Message-ID: <200901140858.n0E8wE9v099032@www262.sakura.ne.jp> (raw)
In-Reply-To: <alpine.LRH.1.10.0901052007350.16049@tundra.namei.org>
James Morris wrote:
> > (3) /proc/PID/ is represented as /proc/self/ if PID equals current->tgid.
>
> This needs an ack from Al and/or Christoph.
>
It is a sad thing that I cannot use /proc/self/ (which is the only part where
a pathname based access control can prevent current process from accessing
other process's information), but I purged d_realpath() for now.
Next posting (#15) will embed AppArmor's d_namespace_path()-like function
into TOMOYO's code.
/* d_namespace_path() in OpenSUSE 11.1's 2.6.27.7-9.1 kernel. */
char *d_namespace_path(struct dentry *dentry, struct vfsmount *vfsmnt,
char *buf, int buflen)
{
struct path root, tmp, ns_root = { };
struct path path = { .mnt = vfsmnt, .dentry = dentry };
char *res;
read_lock(¤t->fs->lock);
root = current->fs->root;
path_get(¤t->fs->root);
read_unlock(¤t->fs->lock);
spin_lock(&vfsmount_lock);
if (root.mnt && root.mnt->mnt_ns)
ns_root.mnt = mntget(root.mnt->mnt_ns->root);
if (ns_root.mnt)
ns_root.dentry = dget(ns_root.mnt->mnt_root);
spin_unlock(&vfsmount_lock);
tmp = ns_root;
res = __d_path(&path, &tmp, buf, buflen,
D_PATH_FAIL_DELETED | D_PATH_DISCONNECT);
path_put(&root);
path_put(&ns_root);
/* Prevent empty path for lazily unmounted filesystems. */
if (!IS_ERR(res) && *res == '\0')
*--res = '.';
return res;
}
Thanks.
next prev parent reply other threads:[~2009-01-14 8:59 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-01-01 5:07 [TOMOYO #14 (mmotm 2008-12-30-16-05) 00/10] TOMOYO Linux Tetsuo Handa
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 01/10] Add in_execve flag into task_struct Tetsuo Handa
2009-01-05 8:25 ` James Morris
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 02/10] Singly linked list implementation Tetsuo Handa
2009-01-05 9:07 ` James Morris
2009-01-06 8:13 ` Tetsuo Handa
2009-01-06 9:11 ` James Morris
2009-01-07 6:36 ` Tetsuo Handa
2009-01-07 19:09 ` Serge E. Hallyn
2009-01-08 6:19 ` Tetsuo Handa
2009-01-14 8:57 ` Tetsuo Handa
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 03/10] Introduce d_realpath() Tetsuo Handa
2009-01-05 9:08 ` James Morris
2009-01-14 8:58 ` Tetsuo Handa [this message]
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 04/10] Memory and pathname management functions Tetsuo Handa
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 05/10] Common functions for TOMOYO Linux Tetsuo Handa
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 06/10] File operation restriction part Tetsuo Handa
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 07/10] Domain transition handler Tetsuo Handa
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 08/10] LSM adapter functions Tetsuo Handa
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 09/10] Kconfig and Makefile Tetsuo Handa
2009-01-01 5:07 ` [TOMOYO #14 (mmotm 2008-12-30-16-05) 10/10] MAINTAINERS info Tetsuo Handa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200901140858.n0E8wE9v099032@www262.sakura.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=akpm@linux-foundation.org \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).