From: Andrew Morton <akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public•gmane.org>
To: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public•gmane.org (Eric W. Biederman)
Cc: paul.moore-VXdhtT5mjnY@public•gmane.org,
sds-+05T5uksL2qpZYMLLGbcSA@public•gmane.org,
jmorris-gx6/JNMH7DfYtjvyW6yDsg@public•gmane.org,
rjw-KKrjLPT3xs0@public•gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public•gmane.org,
kernel-testers-u79uwXL29TY76Z2rM5mHXA@public•gmane.org,
netdev-u79uwXL29TY76Z2rM5mHXA@public•gmane.org
Subject: Re: [Bug #11500] /proc/net bug related to selinux
Date: Wed, 17 Sep 2008 15:11:43 -0700 [thread overview]
Message-ID: <20080917151143.debb6adc.akpm@linux-foundation.org> (raw)
In-Reply-To: <m1vdwu4fku.fsf-B27657KtZYmhTnVgQlOflh2eb7JE58TQ@public.gmane.org>
On Wed, 17 Sep 2008 14:39:45 -0700
ebiederm-aS9lmoZGLiVWk0Htik3J/w@public•gmane.org (Eric W. Biederman) wrote:
> Paul Moore <paul.moore-VXdhtT5mjnY@public•gmane.org> writes:
>
> > We suck? Maybe, but some explanation about why we suck in this
> > particular case would be helpful as far as I'm concerned. I don't
> > really care about identifying the guilty suckees, I'm more interested
> > in finding out what happened to cause us to suck because of this.
>
> Agreed. I believe we carefully gave selinux the same paths for /proc/net
> that it had before so I don't know why this affects user space.
>
> I know we had some selinux review when we made the change.
>
> Eric
It's back up-thread somewhere. umm...
On Mon, 15 Sep 2008 09:05:26 -0400
Stephen Smalley <sds-+05T5uksL2qpZYMLLGbcSA@public•gmane.org> wrote:
> However, the most likely explanation is simply that when /proc/net was
> changed from being a directory to being a symlink to /proc/self/net,
> that introduced an additional permission check on accesses
> of /proc/net/<whatever>, namely the read check on the symlink itself.
> And since that check wasn't happening on /proc/net accesses with older
> kernels, older policies didn't allow it.
next prev parent reply other threads:[~2008-09-17 22:11 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <j3zWxt-CgYL.A.WTF.bbsyIB@albercik>
[not found] ` <SpS7rta8n4.A.DCB.IfsyIB@albercik>
2008-09-13 8:47 ` [Bug #11271] BUG: fealnx in 2.6.27-rc1 Jaswinder Singh
[not found] ` <SpS7rta8n4.A.i9G.ZcsyIB@albercik>
[not found] ` <alpine.LRH.1.10.0809130812460.12313@tundra.namei.org>
[not found] ` <20080912152443.c4e59f42.akpm@linux-foundation.org>
[not found] ` <alpine.LRH.1.10.0809131012310.13073@tundra.namei.org>
[not found] ` <20080913123722.e238ae2a.akpm@linux-foundation.org>
[not found] ` <1221483926.30816.18.camel@moss-spartans.epoch.ncsc.mil>
[not found] ` <1221483926.30816.18.camel-/ugcdrsPCSfIm9DtXLC9OUVfdvkotuLY+aIohriVLy8@public.gmane.org>
2008-09-17 19:50 ` [Bug #11500] /proc/net bug related to selinux Andrew Morton
2008-09-17 21:24 ` Paul Moore
2008-09-17 21:39 ` Eric W. Biederman
[not found] ` <m1vdwu4fku.fsf-B27657KtZYmhTnVgQlOflh2eb7JE58TQ@public.gmane.org>
2008-09-17 22:11 ` Andrew Morton [this message]
2008-09-17 21:48 ` Andrew Morton
2008-09-17 22:12 ` Paul Moore
2008-09-17 22:24 ` Andrew Morton
[not found] ` <20080917152407.76230f0c.akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>
2008-09-17 22:53 ` Eric W. Biederman
[not found] ` <20080917144842.7df59f9e.akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>
2008-09-17 22:32 ` Eric W. Biederman
2008-09-18 12:38 ` Stephen Smalley
2008-09-18 13:03 ` Stephen Smalley
2008-09-18 18:09 ` Eric W. Biederman
2008-09-18 18:34 ` Stephen Smalley
[not found] ` <1221762850.24048.107.camel-/ugcdrsPCSfIm9DtXLC9OUVfdvkotuLY+aIohriVLy8@public.gmane.org>
2008-09-19 16:58 ` david-gFPdbfVZQbY
2008-09-19 17:07 ` Stephen Smalley
2008-09-29 16:49 ` Stephen Smalley
[not found] ` <200809171724.36269.paul.moore-VXdhtT5mjnY@public.gmane.org>
2008-09-17 22:23 ` David Miller
[not found] ` <20080917125053.1f9ecf37.akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>
2008-09-17 21:56 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080917151143.debb6adc.akpm@linux-foundation.org \
--to=akpm-de/tnxtf+jlsfhdxvbkv3wd2fqjk+8+b@public$(echo .)gmane.org \
--cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public$(echo .)gmane.org \
--cc=jmorris-gx6/JNMH7DfYtjvyW6yDsg@public$(echo .)gmane.org \
--cc=kernel-testers-u79uwXL29TY76Z2rM5mHXA@public$(echo .)gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public$(echo .)gmane.org \
--cc=netdev-u79uwXL29TY76Z2rM5mHXA@public$(echo .)gmane.org \
--cc=paul.moore-VXdhtT5mjnY@public$(echo .)gmane.org \
--cc=rjw-KKrjLPT3xs0@public$(echo .)gmane.org \
--cc=sds-+05T5uksL2qpZYMLLGbcSA@public$(echo .)gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox