[PATCH 1/1] NAX LSM: Add initial support support

THOBY Simon Simon.THOBY at viveris.fr
Fri Aug 13 08:23:58 UTC 2021

Hi Igor,

On 8/13/21 10:05 AM, Igor Zhbanov wrote:
> Hi Simon,
>> Yes, what I meant was that maybe you could just declare it at the beginning of the function,
>> and not use it at all in the sysctl table. Because as I see it, you only use allowed_caps_hex in the sysctl
>> table to copy the string to that temporary (variable), and its use is limited to that one function.
>> Instead of:
>> +               if ((error = proc_dostring(table, write, buffer, lenp, ppos)))
>> +                       return error;
> ...
>> You could probably get away with something like:
> ...
>> +       strncpy(allowed_caps_hex, buffer, ALLOWED_CAPS_HEX_LEN + 1);
> proc_dostring() is more than simple strncpy(). It is handling offsets too.
> I.e. if a user will try to write not from the starting position. But
> I've seen that some
> functions simply create an instance of struct ctl_table, fill it and
> call needed function.

Oh you're right, I assumed the sysctls write always had to be written from position zero,
but I just learned of 'sysctl_writes_strict': even though by default the kernel forbid
writes at another offset than zero or partial writes on sysctl files, users can enable
a more permissive behavior like 'SYSCTL_WRITES_LEGACY'.
Sorry about that.

> Thanks.


More information about the Linux-security-module-archive mailing list