On Sun, Apr 14, 2019 at 07:04:14PM +0300, Amir Goldstein wrote: > Another problem is that they seem to be bypassed by several subsystems. > cachefiles, ecryptfs, overlayfs and nfsd all call the vfs_rename() helper, but > only cachefiles bothers to call the security_path_rename() hook. > This is of course true for all other security_path_ hooks. > I think that is something that requires fixing regardless of the fanotify pre > modification hooks. I wonder if tomoyo and apparmor developers > (LSM that implement security_path_ hooks) are aware of those missing > hooks? First of all, _what_ path? You do realize that there is no such thing as *the* pathname of dentry, right? The same filesystem may be mounted in any number of places, some of which might be visible in a given namespace (including "none of them" - and you are not even guaranteed that they are visible in any namespace at all). It's not "bypassed", it's "inapplicable and deeply flawed in general".
