Casey Schaufler c0ab6e56dc Smack: Implement lock security mode ...

Linux file locking does not follow the same rules
as other mechanisms. Even though it is a write operation
a process can set a read lock on files which it has open
only for read access. Two programs with read access to
a file can use read locks to communicate.

This is not acceptable in a Mandatory Access Control
environment. Smack treats setting a read lock as the
write operation that it is. Unfortunately, many programs
assume that setting a read lock is a read operation.
These programs are unhappy in the Smack environment.

This patch introduces a new access mode (lock) to address
this problem. A process with lock access to a file can
set a read lock. A process with write access to a file can
set a read lock or a write lock. This prevents a situation
where processes are granted write access just so they can
set read locks.

Targeted for git://git.gitorious.org/smack-next/kernel.git

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>

2013-10-18 09:39:33 -07:00

..

Kconfig

Smack: use select not depends in Kconfig

2012-12-14 10:57:10 -08:00

Makefile

Smack: Simplified Mandatory Access Control Kernel

2008-02-05 09:44:20 -08:00

smack_access.c

Smack: Implement lock security mode

2013-10-18 09:39:33 -07:00

smack_lsm.c

Smack: Implement lock security mode

2013-10-18 09:39:33 -07:00

smack.h

Smack: Implement lock security mode

2013-10-18 09:39:33 -07:00

smackfs.c

Smack: Implement lock security mode

2013-10-18 09:39:33 -07:00