On Wednesday 23 September 2009 16:26:49 Davide Libenzi wrote:

On Wed, 23 Sep 2009, Tvrtko Ursulin wrote:

quoted

Lived with it because there was no other option. We used LSM while it was
available for modules but then it was taken away.

And not all vendors even use syscall interception, not even across
platforms, of which you sound so sure about. You can't even scan
something which is not in your namespace if you are at the syscall level.
And you can't catch things like kernel nfsd. No, syscall interception is
not really appropriate at all.

Really?
And *if* namespaces were the problem for the devices you were targeting,
what prevented you to resolving the object and offering a stream to
userspace?

You are right, nothing really, we even do it like that today. But what about 
other interested users?

In *your* module, hosting at the same time all the other logic required
for it (caches, whitelists, etc...), instead of pushing this stuff into
the kernel.
WRT to the "other" system, never said they were using syscall
interception, if you read carefully. I said that minifilters typically
sends path names to userspace, which might drive you in the pitfall
Andreas was describing.

Yeah, you could do something like kauth on OSX, which is I guess similar to 
LSM, which was turned off for out of tree. And now you want to push users of 
fanotify out of tree, so what should it be? In tree bad, out of tree bad? 

Tvrtko