Re: [RFC][PATCH 2/3] netlink check sender, audit

[Chris Wright <chrisw@xxxxxxxx>]

* Pablo Neira (pablo@xxxxxxxxxxx) wrote:
> Thanks for the explanation. I don't still like so much the new 
> netlink_kernel_create_check function. I think that we could get more 
> variations of netlink_kernel_create in future just to add another 
> feature/checking. So I prefer new function (netlink_kernel_set_check) 

I agree, had the same concern.  I breifly considered an ops struct that
could be passed in during registration so that it could grow a little
easier.

> that set check_sender if it's needed once the netlink socket is created. 
> I've modified your patches to use this function.

Great, thanks.  This is technically racy.  It's possible (albeit small
window) that something could be delivered before this is set.  Using a
callback struct during registration would fix this.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net