Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread Andreas Dilger
Any chance you can remove linux-fsdevel from the CC list? I don't think this has anything to do with filesystems. Cheers, Andreas -- Andreas Dilger Principal Software Engineer Cluster File Systems, Inc. - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a m

DIO panic on 2.6.21.5

2007-06-27 Thread Badari Pulavarty
Hi Zach, One of our perf. team ran into this while doing some runs. I didn't see anything obvious - it looks like we converted async IO to synchronous one. I didn't spend much time digging around. Is this a known issue ? Any ideas ? Thanks, Badari [ cut here ] kernel BU

Re: [RFC] fsblock

2007-06-27 Thread Nick Piggin
On Thu, Jun 28, 2007 at 08:35:48AM +1000, David Chinner wrote: > On Wed, Jun 27, 2007 at 07:50:56AM -0400, Chris Mason wrote: > > Lets look at a typical example of how IO actually gets done today, > > starting with sys_write(): > > > > sys_write(file, buffer, 1MB) > > for each page: > > prepar

Re: [RFC:PATCH] How best to handle implicit clearing of setuid/setgid bits on NFS?

2007-06-27 Thread Jeff Layton
On Wed, 27 Jun 2007 18:15:55 -0400 Trond Myklebust <[EMAIL PROTECTED]> wrote: > On Tue, 2007-05-29 at 12:47 -0400, Jeff Layton wrote: > > I've been looking at issue of clearing setuid/setgid bits when a file > > is written to on NFS. Here's the problem in a nutshell: > > > > We have 2 users. test

Re: [PATCH 4/7][TAKE5] support new modes in fallocate

2007-06-27 Thread Nathan Scott
On Thu, 2007-06-28 at 10:39 +1000, David Chinner wrote: > > > I don't think it does - swapfile I/O looks like it goes direct to > bio without passing through the filesystem. When the swapfile is > mapped, it scans and records the extent map of the entire swapfile > in a separate structure and AF

Re: [PATCH 4/7][TAKE5] support new modes in fallocate

2007-06-27 Thread David Chinner
On Thu, Jun 28, 2007 at 09:28:36AM +1000, Nathan Scott wrote: > On Wed, 2007-06-27 at 23:36 +1000, David Chinner wrote: > > Allows setup_swap_extents() to use preallocated files on XFS > > filesystems for swap files without ever needing to convert them. > > Using unwritten extents (as opposed

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread David Miller
From: Casey Schaufler <[EMAIL PROTECTED]> Date: Wed, 27 Jun 2007 17:27:17 -0700 (PDT) > --- David Miller <[EMAIL PROTECTED]> wrote: > > > Neither of those are reasons why something should go into the tree. > > They reflect the corporate reality of the open source community. > If you're going to

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread Casey Schaufler
--- David Miller <[EMAIL PROTECTED]> wrote: > From: Crispin Cowan <[EMAIL PROTECTED]> > Date: Wed, 27 Jun 2007 15:46:57 -0700 > > > But we do not want to prevent other people from using SELinux if it > > suits them. Linux is about choice, and that is especially vital in > > security. As Linus hi

Re: [PATCH 4/7][TAKE5] support new modes in fallocate

2007-06-27 Thread Nathan Scott
On Wed, 2007-06-27 at 23:36 +1000, David Chinner wrote: > Allows setup_swap_extents() to use preallocated files on XFS > filesystems for swap files without ever needing to convert them. Using unwritten extents (as opposed to the MKSWAP flag mentioned earlier) has the unfortunate down side of

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread David Miller
From: Crispin Cowan <[EMAIL PROTECTED]> Date: Wed, 27 Jun 2007 15:46:57 -0700 > But we do not want to prevent other people from using SELinux if it > suits them. Linux is about choice, and that is especially vital in > security. As Linus himself observed when LSM was started, there are a > lot of

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread Crispin Cowan
Sean wrote: > On Wed, 27 Jun 2007 14:06:04 -0700 > Crispin Cowan <[EMAIL PROTECTED]> wrote: > >> I am hoping for a reconciliation where the people who don't like >> AppArmor live with it by not using it. AppArmor is not intended to >> replace SELinux, it is intended to address a different set of

Re: [RFC] fsblock

2007-06-27 Thread David Chinner
On Wed, Jun 27, 2007 at 07:50:56AM -0400, Chris Mason wrote: > On Wed, Jun 27, 2007 at 07:32:45AM +0200, Nick Piggin wrote: > > On Tue, Jun 26, 2007 at 08:34:49AM -0400, Chris Mason wrote: > > > On Tue, Jun 26, 2007 at 07:23:09PM +1000, David Chinner wrote: > > > > On Tue, Jun 26, 2007 at 01:55:11P

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread Sean
On Wed, 27 Jun 2007 14:06:04 -0700 Crispin Cowan <[EMAIL PROTECTED]> wrote: > I am hoping for a reconciliation where the people who don't like > AppArmor live with it by not using it. AppArmor is not intended to > replace SELinux, it is intended to address a different set of goals. You keep sayin

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread Crispin Cowan
Adrian Bunk wrote: > On Tue, Jun 26, 2007 at 07:47:00PM -0700, Andrew Morton wrote: > >> Do you agree with the "irreconcilable" part? I think I do. I am hoping for a reconciliation where the people who don't like AppArmor live with it by not using it. AppArmor is not intended to replace SELinu

Re: [RFD 0/4] AppArmor - Don't pass NULL nameidata to vfs_create/lookup/permission IOPs

2007-06-27 Thread Andreas Gruenbacher
On Wednesday 27 June 2007 01:46, Trond Myklebust wrote: > On Tue, 2007-06-26 at 16:15 -0700, [EMAIL PROTECTED] wrote: > > To remove conditionally passing of vfsmounts to the LSM, a nameidata > > struct can be instantiated in the nfsd and mqueue filesystems. This > > however results in useless info

Re: [RFC] fsblock

2007-06-27 Thread Anton Altaparmakov
On 27 Jun 2007, at 12:50, Chris Mason wrote: On Wed, Jun 27, 2007 at 07:32:45AM +0200, Nick Piggin wrote: On Tue, Jun 26, 2007 at 08:34:49AM -0400, Chris Mason wrote: On Tue, Jun 26, 2007 at 07:23:09PM +1000, David Chinner wrote: On Tue, Jun 26, 2007 at 01:55:11PM +1000, Nick Piggin wrote: [

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread Adrian Bunk
On Tue, Jun 26, 2007 at 07:47:00PM -0700, Andrew Morton wrote: > On Tue, 26 Jun 2007 19:24:03 -0700 John Johansen <[EMAIL PROTECTED]> wrote: > > > > > > > so... where do we stand with this? Fundamental, irreconcilable > > > differences over the use of pathname-based security? > > > > > There c

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread Andreas Gruenbacher
On Wednesday 27 June 2007 12:58, Kyle Moffett wrote: > I seem to recall you could actually end up racing and building a path > to the file in those directories as "a/d/0/3" or some other path at > which it never even remotely existed. I'd love to be wrong, Cheer up, you recall wrong. > but I can'

Re: [PATCH 4/7][TAKE5] support new modes in fallocate

2007-06-27 Thread David Chinner
On Tue, Jun 26, 2007 at 11:49:15PM -0400, Andreas Dilger wrote: > On Jun 27, 2007 09:14 +1000, David Chinner wrote: > > Someone on the XFs list had an interesting request - preallocated > > swap files. You can't use unwritten extents for this because > > of sys_swapon()s use of bmap() (XFS returns

Re: [RFC] fsblock

2007-06-27 Thread Kyle Moffett
On Jun 26, 2007, at 07:14:14, Nick Piggin wrote: On Tue, Jun 26, 2007 at 07:23:09PM +1000, David Chinner wrote: Can we call it a block mapping layer or something like that? e.g. struct blkmap? I'm not fixed on fsblock, but blkmap doesn't grab me either. It is a map from the pagecache to the

Re: [RFC] fsblock

2007-06-27 Thread Chris Mason
On Wed, Jun 27, 2007 at 07:32:45AM +0200, Nick Piggin wrote: > On Tue, Jun 26, 2007 at 08:34:49AM -0400, Chris Mason wrote: > > On Tue, Jun 26, 2007 at 07:23:09PM +1000, David Chinner wrote: > > > On Tue, Jun 26, 2007 at 01:55:11PM +1000, Nick Piggin wrote: > > > > [ ... fsblocks vs extent range m

Re: [AppArmor 00/44] AppArmor security module overview

2007-06-27 Thread Kyle Moffett
On Jun 26, 2007, at 22:24:03, John Johansen wrote: other issues that have been raised are: - the use of d_path to generate the pathname used for mediation when a file is opened. - Generating the pathname using a reverse walk is considered ugly A little more than "ugly". In this basic concu