[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Dazuko-devel] Re: [Dazuko-help] Dazuko and Linux 2.6

From: John Ogness
Subject: [Dazuko-devel] Re: [Dazuko-help] Dazuko and Linux 2.6
Date: Fri, 14 Nov 2003 20:49:22 +0100
User-agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.4) Gecko/20030907


Yes, I have been keeping my eye on 2.5/2.6. I am about to release Dazuko version 2.0, which has been a major achievement for Dazuko (and a *lot* of work). Once it is available, I will be able to start focussing on Linux 2.6 (and FreeBSD 5).

In 2.4 (and earlier) there was no way that you could implement your own file access security module without major patches to the kernel. As a result, Dazuko hooks the system call, thus allowing it to have first say for file accesses (without requiring kernel patches). Although this works, it fits more into the category of "hacking the kernel" rather than "securing the kernel".

With 2.5/2.6, Linux provides an interface for implementing your own file access security module. This means that Dazuko will no longer need to hook the system calls. Although this makes Dazuko's job easier, it will require me (or someone) to appropriately match the Linux 2.6 security API to Dazuko. I have seen several examples of this and it looks like getting the access information to Dazuko will be the easy part.

However, I have not yet looked at the virtual file system, chroot models, and local name lookups for the new kernel. I am a lot more worried that these (more complex) pieces have changed considerably. (I am assuming they've changed because they changed quite a bit from 2.2 to 2.4.)

I will most likely start working on the 2.6 port in December. If you subscribe the the dazuko-devel mailing list, we can start tackling this issue together.

John Ogness

Michael Grigoriev wrote:

I've been considering using Dazuko to get file access/change notifications
in my network filesystem [http://www.luminal.org/wiki/index.php/FunFS].

Dazuko would allow me subscribe to notifications on an entire subtree in one
go instead of having to subscribe to every file, like FAM. It would also let
me block attempts to open files long enough for me to possibly get an oplock
on it, thus delaying access further giving the filesystem time for force any
client with outstanding write cache to flush it. In other words, it would be
really useful.

As I do most of my development on Linux 2.5/2.6, I started looking into
porting Dazuko to it. But here's the problem: it appears that sys_call_table
is no longer exported to the modules (starting with 2.5.41 I think).

Here's some related information I was able to find on LKML:

It's unexported because there is no correct use for it and that it can't
be used correctly either. Tell me which lock your module uses to protect
modifications to it? Tell me how you handle other modules trying to
overload the same syscall and those modules loading before your module but
then unloading while yours is still loaded?

It's the wrong mechanism to do ANYTHING. Really.

So I was wondering if you've looked at 2.6 support at all, and if you had
any ideas about how to do it.

Thanks in advance.

Dazuko Maintainer

reply via email to

[Prev in Thread] Current Thread [Next in Thread]