On Wednesday 15 December 2004 03:22, Casey Schaufler <casey@schaufler-ca.com> wrote:
> > How does the application determine the real
> > effective set?
>
> The short answer is that it doesn't. How do you
> determine if you can really open a file for write
> access? The real world behavior is to check what
> you know about (e.g. UID, mode bits) and hope that
> you'll pass any additinoal constraints (e.g. ACLS,
> capabilities, mount options) that might apply. Then
> try it and check the error return.

Doesn't access(2) deal with ACLs and mount options?

> which is a generalized version of access(2), that
> notoriously unuseful syscall. Needless to say, such
> an inferface is impracticle and would still yield
> false positives.

A faccess(2) syscall would be handy if you are contributing to further POSIX standards...

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.