Re: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2)

2007-08-07 Thread Serge E. Hallyn
Quoting James Morris ([EMAIL PROTECTED]): > On Tue, 7 Aug 2007, Serge E. Hallyn wrote: > > > Shall I resend without the LSM_NEED_LOCK, or do you still want a more > > fundamental change? > > > Removing the needlock is enough, the rest was just a query/suggestion. Ok - I'll explictly lock the i_

Re: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2)

2007-08-07 Thread James Morris
On Tue, 7 Aug 2007, Serge E. Hallyn wrote: > Shall I resend without the LSM_NEED_LOCK, or do you still want a more > fundamental change? Removing the needlock is enough, the rest was just a query/suggestion. -- James Morris <[EMAIL PROTECTED]> - To unsubscribe from this list: send the line "u

Re: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2)

2007-08-07 Thread Serge E. Hallyn
> > Subject: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2) > > > > When a file with posix capabilities is overwritten, the > > file capabilities, like a setuid bit, should be removed. > > > > This patch introduces security_inode_killpriv().

Re: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2)

2007-08-07 Thread Serge E. Hallyn
Quoting James Morris ([EMAIL PROTECTED]): > On Mon, 6 Aug 2007, Serge E. Hallyn wrote: > > > + err = security_inode_killpriv(out->f_path.dentry, LSM_NEED_LOCK); > > + if (err) > > + return err; > > + > > err = should_remove_suid(out->f_path.dentry); > > if (unlikely(err)) { >

Re: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2)

2007-08-07 Thread Stephen Smalley
On Mon, 2007-08-06 at 13:52 -0500, Serge E. Hallyn wrote: > >From 1376764cbb54243f088cf00c39000c4f4418f461 Mon Sep 17 00:00:00 2001 > From: Serge E. Hallyn <[EMAIL PROTECTED]> > Date: Mon, 6 Aug 2007 14:20:06 -0400 > Subject: [PATCH 1/1] file capabilities: clear fcap

Re: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2)

2007-08-07 Thread James Morris
On Mon, 6 Aug 2007, Serge E. Hallyn wrote: > + err = security_inode_killpriv(out->f_path.dentry, LSM_NEED_LOCK); > + if (err) > + return err; > + > err = should_remove_suid(out->f_path.dentry); > if (unlikely(err)) { > mutex_lock(&inode->i_mutex); It

Re: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2)

2007-08-06 Thread Andrew Morgan
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Serge E. Hallyn wrote: >>From 1376764cbb54243f088cf00c39000c4f4418f461 Mon Sep 17 00:00:00 2001 > From: Serge E. Hallyn <[EMAIL PROTECTED]> > Date: Mon, 6 Aug 2007 14:20:06 -0400 > Subject: [PATCH 1/1] file capabilities: clear

[PATCH 1/1] file capabilities: clear fcaps on inode change (v2)

2007-08-06 Thread Serge E. Hallyn
>From 1376764cbb54243f088cf00c39000c4f4418f461 Mon Sep 17 00:00:00 2001 From: Serge E. Hallyn <[EMAIL PROTECTED]> Date: Mon, 6 Aug 2007 14:20:06 -0400 Subject: [PATCH 1/1] file capabilities: clear fcaps on inode change (v2) When a file with posix capabilities is overwritten, the file cap