Re: [PATCH v2 1/2] security: Add hook to invalidate inode security labels

2015-10-06 Thread Stephen Smalley
On 10/05/2015 05:56 PM, Andreas Gruenbacher wrote: > On Mon, Oct 5, 2015 at 5:08 PM, Stephen Smalley wrote: >> Not fond of these magic initialized values. > > That should be a solvable problem. > >> Is it always safe to call inode_doinit() from all callers of >> inode_has_perm()? > > As long as

Re: [PATCH v2 1/2] security: Add hook to invalidate inode security labels

2015-10-05 Thread Andreas Gruenbacher
On Mon, Oct 5, 2015 at 5:08 PM, Stephen Smalley wrote: > Not fond of these magic initialized values. That should be a solvable problem. > Is it always safe to call inode_doinit() from all callers of > inode_has_perm()? As long as inode_has_perm is only used in contexts in which a file permissio

Re: [PATCH v2 1/2] security: Add hook to invalidate inode security labels

2015-10-05 Thread Andreas Gruenbacher
On Mon, Oct 5, 2015 at 8:24 PM, Casey Schaufler wrote: > On 10/4/2015 12:19 PM, Andreas Gruenbacher wrote: >> Add a hook to invalidate an inode's security label when the cached >> information becomes invalid. > > Where is this used? See the next patch in this patch queue, gfs2. > If I need to do

Re: [PATCH v2 1/2] security: Add hook to invalidate inode security labels

2015-10-05 Thread Casey Schaufler
On 10/4/2015 12:19 PM, Andreas Gruenbacher wrote: > Add a hook to invalidate an inode's security label when the cached > information becomes invalid. Where is this used? If I need to do the same for Smack or any other module, how would I know that it works right? > > Implement the new hook in sel

Re: [PATCH v2 1/2] security: Add hook to invalidate inode security labels

2015-10-05 Thread Stephen Smalley
On 10/04/2015 03:19 PM, Andreas Gruenbacher wrote: Add a hook to invalidate an inode's security label when the cached information becomes invalid. Implement the new hook in selinux: set a flag when a security label becomes invalid. When hitting a security label which has been marked as invalid