Re: [PATCH v5 2/2] staging: ion: create one device entry per heap

On 10/10/2017 02:11 AM, Mark Brown wrote:

On Mon, Oct 09, 2017 at 05:10:37PM -0700, Laura Abbott wrote:

quoted

On 10/09/2017 03:08 PM, Mark Brown wrote:

quoted

On Mon, Oct 09, 2017 at 02:25:47PM -0700, Laura Abbott wrote:

quoted

quoted

quoted

Anyway, to move this forward I think we need to see a proof of concept
of using selinux to protect access to specific heaps.

quoted

quoted

Aren't Unix permissions enough with separate files or am I
misunderstanding what you're looking to see a proof of concept for?

quoted

The goal is to be able to restrict heap access to certain services
and selinux groups on Android so straight unix permissions aren't
sufficient.

Oh, there's Android users for this?  The users I was aware of were
non-Android.  Though even so I'd have thought that given that SELinux is
a superset of Unix file permissions it ought to be sufficient to be able
to use them.  I'd been thinking people were suggesting SELinux as a
replacement for file permissions, using the single file and the greater
capabilities of SELinux.

Unix file permissions are necessary but not sufficient, they
can be used separately. Mostly what I want to see before
merging this is an example that splitting the Ion heaps provides
more protection than just keeping /dev/ion.

Thanks,
Laura
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel