On Tue, 2007-04-17 at 16:09 -0700, Crispin Cowan wrote: > David Safford wrote: > > On Mon, 2007-04-16 at 20:20 -0400, James Morris wrote: > > <snip> > > The meaning of a file is how other processes interpret it. Until then, > /etc/resolv.conf is just a quaint bag of bits. What makes it special is > that it is what each process gets when they open the well-known > "/etc/resolv.conf". Which is why it is useful to guard which processes > can read or write to /etc/resolv.conf; the name is what makes its > content special, not the other way around. > This is not correct. My private ssh keys need to be protected regardless of the file name - it is the "bag of bits" that make it important not the name. Similarly, you protect the integrity of the applications that need name resolution by ensuring that the data that they read is high integrity. You do that by controlling data not the file name used to access the data. That is James point - a comprehensive mechanism like SELinux allows you to comprehensively protect the integrity of data. Karl > Crispin > - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
