[trustees] Re: Trustees 3.0 as module doesn't work?

[<ae...@ks...>]

Quoting Heiko Noordhof <hei...@xs...>:

> However, when statically linked into the kernel, it seems to work.
> But
> I'd like to be able to unload the module to be able to create
> hardlinks.

I've recently found out that in the early startup of Debian (in the
initrd) the capabilities module is loaded.  Unfortunately, until the
security module stacking code makes it into mainline kernel (allowing
multiple security modules), this will disallow trustees from loading.
Since the loading is done so early, it is rather difficult to load the
trustees module prior to the capabilities module, which is why you are
running into problems.  You can perhaps rmmod the capabilities module
and load the trustees module instead.

Also, as root you should always be able to create hard links fine.

Also, in the latest subversion, I have code to allow hard links between
directories under the same trustee object.  That way if you have a
trustee object(s) for /home, your users would be free to create hard
links to/from files within their home directories (even into different
directories under /home).  I will admit, though, I have received very
little feedback on this new feature.  It seems to work for me, but I've
been unable to test it fully yet so your mileage may vary.


Thanks,
Andrew Ruder

P.S.   The capability module is called "capability" or "commoncap" if
you want to try the rmmod approach.

--
Andrew E. Ruder <ae...@ks...>
http://www.aeruder.net