Re: [PATCH] Reporting file descriptors created by pipe and socketpair
On Tue, Sep 12, 2006 at 12:07:13PM -0400, John D. Ramsdell wrote:
The polgen tools suggest SELinux policy by analyzing dynamic traces
of
a running set of related programs. It derives information flow by
tracking file descriptors used by a set of programs, and notes which
processes performs reads and writes. We would very much like to get
our raw data from autrace, however, the current traces it generates
lacks some crucial information. The record for the pipe and
socketpair system call does not include the file descriptors created
upon success. Enclosed is a patch by Mark Workman that remedies this
problem.
NAK
a) __NR_socketpair is not universally present
b) neither __NR_socketpair nor __NR_pipe are guaranteed to be the
same for 32bit and 64bit syscalls.
c) just how do you propose to do "tracking file descriptors"? It's
so trivial to confuse that it's not even funny; pass an SCM_RIGHTS
datagram to yourself and watch that code blow chunks. Moreover,
several threads can very legitimately share descriptor table and
work with it in parallel. Have fun figuring out the sequence of
those events...
IOW, it's broken by design.