From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ig0-f171.google.com (mail-ig0-f171.google.com [209.85.213.171]) by kanga.kvack.org (Postfix) with ESMTP id B2A066B020C for ; Thu, 20 Mar 2014 11:13:36 -0400 (EDT) Received: by mail-ig0-f171.google.com with SMTP id hl1so15134043igb.4 for ; Thu, 20 Mar 2014 08:13:36 -0700 (PDT) Received: from mail-ig0-x234.google.com (mail-ig0-x234.google.com [2607:f8b0:4001:c05::234]) by mx.google.com with ESMTPS id n7si5091656iga.32.2014.03.20.08.13.34 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 20 Mar 2014 08:13:35 -0700 (PDT) Received: by mail-ig0-f180.google.com with SMTP id hl1so2361881igb.1 for ; Thu, 20 Mar 2014 08:13:34 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <20140320144127.1d411f26@alan.etchedpixels.co.uk> References: <1395256011-2423-1-git-send-email-dh.herrmann@gmail.com> <20140320144127.1d411f26@alan.etchedpixels.co.uk> Date: Thu, 20 Mar 2014 16:12:54 +0100 Message-ID: Subject: Re: [PATCH 0/6] File Sealing & memfd_create() From: David Herrmann Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-linux-mm@kvack.org List-ID: To: One Thousand Gnomes Cc: Linus Torvalds , Linux Kernel Mailing List , Hugh Dickins , Alexander Viro , Karol Lewandowski , Kay Sievers , Daniel Mack , Lennart Poettering , =?ISO-8859-1?Q?Kristian_H=F8gsberg?= , John Stultz , Greg Kroah-Hartman , Tejun Heo , Johannes Weiner , DRI , linux-fsdevel , linux-mm , Andrew Morton , Ryan Lortie , "Michael Kerrisk (man-pages)" Hi On Thu, Mar 20, 2014 at 3:41 PM, One Thousand Gnomes wrote: > I think you want two things at minimum > > owner to seal > root can always override Why should root be allowed to override? > I would query the name too. Right now your assumption is 'shmem only' but > that might change with other future use cases or types (eg some driver > file handles) so SHMEM_ in the fcntl might become misleading. I'm fine with F_SET/GET_SEALS. But given you suggested requiring MFD_ALLOW_SEALS for sealing, I don't see why we couldn't limit this interface entirely to memfd_create(). > Whether you want some way to undo a seal without an exclusive reference as > the file owner is another question. No. You are never allowed to undo a seal but with an exclusive reference. This interface was created for situations _without_ any trust relationship. So if the owner is allowed to undo seals, the interface doesn't make any sense. The only options I see is to not allow un-sealing at all (which I'm fine with) or tracking users (which is way too much overhead). Thanks David -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org