On Mon, 17 Mar 2008, Eric Paris wrote: > > On Mon, 2008-03-17 at 08:55 -0400, Stephen Smalley wrote: > > On Mon, 2008-03-17 at 08:41 +1100, James Morris wrote: > > > On Fri, 14 Mar 2008, Stephen Smalley wrote: > > > > > > > Alternatively, we could default to returning FILE__IOCTL from > > > > file_to_av() if the f_mode has neither FMODE_READ nor FMODE_WRITE, and > > > > thus check ioctl permission on exec or transfer, thereby validating such > > > > descriptors early as with normal r/w descriptors and catching leaks of > > > > them prior to attempted usage. > > > > > > I think this sounds like a good plan. > > > > Handle files opened with flags 3 by checking ioctl permission. > > > > Signed-off-by: Stephen Smalley <sds@xxxxxxxxxxxxx> > > Acked-by: Eric Paris <eparis@xxxxxxxxxx> Fixes the problem I was seeing. Applied to for-akpm. -- James Morris <jmorris@xxxxxxxxx> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
