Re: [RFC][PATCH 1/3] netlink check sender

[Chris Wright <chrisw@xxxxxxxx>]

* Stephen Smalley (sds@xxxxxxxxxxxxx) wrote:
> On Mon, 2005-02-14 at 07:59, Stephen Smalley wrote:
> > printk() is a leftover from debugging, I assume.  
> > Why place the check_sender() call here vs. just replacing the existing
> > security_netlink_send() call in netlink_sendmsg() with this new call?
> 
> Sorry, replacing security_netlink_send() would be bad (for SELinux
> checking), but I'm not clear on why you don't put the check_sender()
> call right after it in netlink_sendmsg() so that you ensure that you
> have complete coverage (vs. unicast-specific).

The receiver hasn't been looked up, so you don't have the
nlk_sk()->check_sender handy yet.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net