From: Davide Libenzi <davidel@xmailserver.org>
To: Nicholas Miell <nmiell@comcast.net>
Cc: Hugh Dickins <hugh@veritas.com>,
Ulrich Drepper <drepper@gmail.com>,
blaisorblade@yahoo.it,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [patch 2/3] MAP_NOZERO - implement sys_brk2()
Date: Wed, 27 Jun 2007 19:58:09 -0700 (PDT) [thread overview]
Message-ID: <Pine.LNX.4.64.0706271954030.5213@alien.or.mcafeemobile.com> (raw)
In-Reply-To: <Pine.LNX.4.64.0706271642340.3879@alien.or.mcafeemobile.com>
On Wed, 27 Jun 2007, Davide Libenzi wrote:
> On Wed, 27 Jun 2007, Nicholas Miell wrote:
>
> > 1) euid is not sufficient, you need to store away arbitrary LSM
> > information and call LSM hooks to decide security equivalence. The same
> > applies to VServer or whatever other container system you use.
>
> The EUID that is used now, can easily be any cookie. It can be an LSM
> cookie (if LSM is active in the system). We don't do complex checks, like
> group permission & Co. We assume that if a UID-cookie had such data
> available (or it generated it), it can have it back uncleared.
(looking through the LSM/SeLinux jungle)
Also, LSM/SeLinux could disable completely the feature, at request. Just
assign a known-to-be-invalid UID to mm->owner_uid (passign through
an(other) hook), and pages will never be recycled.
- Davide
next prev parent reply other threads:[~2007-06-28 2:58 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-06-27 2:44 [patch 2/3] MAP_NOZERO - implement sys_brk2() Davide Libenzi
2007-06-27 3:07 ` Rik van Riel
2007-06-27 3:33 ` Davide Libenzi
2007-06-27 3:45 ` Ulrich Drepper
2007-06-27 4:11 ` Rik van Riel
2007-06-27 5:04 ` Ulrich Drepper
2007-06-27 3:48 ` Ulrich Drepper
2007-06-27 3:55 ` Davide Libenzi
2007-06-27 5:02 ` Ulrich Drepper
2007-06-27 12:32 ` Hugh Dickins
2007-06-27 15:59 ` Davide Libenzi
2007-06-27 17:01 ` Ulrich Drepper
2007-06-27 17:43 ` Hugh Dickins
2007-06-27 18:13 ` Davide Libenzi
2007-06-27 18:32 ` Hugh Dickins
2007-06-27 18:45 ` Davide Libenzi
2007-06-27 22:11 ` Nicholas Miell
2007-06-28 0:17 ` Davide Libenzi
2007-06-28 2:58 ` Davide Libenzi [this message]
2007-06-30 7:52 ` Andrew Morton
2007-06-27 18:52 ` Ulrich Drepper
2007-06-27 19:32 ` Hugh Dickins
2007-06-27 19:00 ` Rik van Riel
2007-06-27 19:22 ` Davide Libenzi
2007-06-27 16:05 ` Davide Libenzi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.64.0706271954030.5213@alien.or.mcafeemobile.com \
--to=davidel@xmailserver.org \
--cc=blaisorblade@yahoo.it \
--cc=drepper@gmail.com \
--cc=hugh@veritas.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nmiell@comcast.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).