Stephen Smalley <[EMAIL PROTECTED]> wrote: > They would correspond with the operations provided by the /dev/cachefiles > interface, at the granularity you want to support distinctions to be made.
Can this be made simpler by the fact that /dev/cachefiles has its own unique label (cachefiles_dev_t). > Could just be a single 'setcontext' permission if that is all you want to > control distinctly, or could be a permission per operation. There is only one operation that makes sense to have a permission: "set context and begin caching". All the other operations on a file descriptor attached to /dev/cachfiles are necessary for there to be a managed cache at all, and given that you've managed to open /dev/cachefiles that's sufficient access for those, I think. > If the latter, you don't really need a label for the object, and can > just use the supplied context/secid as the object of the permission > check, ala: > rc = avc_has_perm(tsec->sid, secid, SECCLASS_CACHEFILES, > CACHEFILES__SETCONTEXT); Ummm. I was under the impression that the target SID had to be a member of target class. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
