David P. Quigley wrote: > Since Casey has withdrawn his NAK for the patch I guess the only other > concern was about the generality of the solution from Eric. Did Steve's > response adequately address this or are there any other questions that > people need answered before Greg can take the patch. > Well, I've withdrawn the NAK, but I would still like to see: Use the xattr, not a secid. Really. An LSM that has multiple attributes is going to get bitten by that one. Also, any LSM that does neither networking nor audit has no need for secids, so I would be happier if the use of secids didn't expand into the file system space. Plus, if it is going to be rare for an xattr to be set in sysfs (Stephen's claim, which is consistent with my experience) saving a real xattr should be no big deal. Replace the security_xattr_to_secid hook in any case. All this is doing is exposing what should be a strictly LSM internal function. You can do it with a combination of existing hooks, if you have the time to code up the error conditions. You can ignore these objections if you feel you must. I'll still buy a round in Portland. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
