Re: [AppArmor 03/41] Remove redundant check from proc_sys_setattr()

2007-04-12 Thread Alan Cox 
On Thu, 12 Apr 2007 02:08:12 -0700
[EMAIL PROTECTED] wrote:

> notify_change() already calls security_inode_setattr() before
> calling iop->setattr.

This is a behaviour change on all of these and limits some behaviour of
existing established security modules

When inode_change_ok is called it has side effects. This includes
clearing the SGID bit on attribute changes caused by chmod. If you make
this change the results of some rulesets may be different before or
after the change is made.

I'm not saying the change is wrong but it does change behaviour so that
needs looking at closely (ditto all other attribute twiddles)

Alan



-
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[AppArmor 03/41] Remove redundant check from proc_sys_setattr()

2007-04-12 Thread jjohansen 
notify_change() already calls security_inode_setattr() before
calling iop->setattr.

Signed-off-by: Steve Beattie <[EMAIL PROTECTED]>
Signed-off-by: Andreas Gruenbacher <[EMAIL PROTECTED]>
Signed-off-by: John Johansen <[EMAIL PROTECTED]>

---
 fs/proc/proc_sysctl.c |7 ++-
 1 file changed, 2 insertions(+), 5 deletions(-)

--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -429,11 +429,8 @@ static int proc_sys_setattr(struct dentr
return -EPERM;
 
error = inode_change_ok(inode, attr);
-   if (!error) {
-   error = security_inode_setattr(dentry, attr);
-   if (!error)
-   error = inode_setattr(inode, attr);
-   }
+   if (!error)
+   error = inode_setattr(inode, attr);
 
return error;
 }

-- 
-
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html