Messages in this thread | | | Subject | Re: [PATCH v4 3/3] LSM: Add context interface for proc attrs | From | Casey Schaufler <> | Date | Fri, 24 Jun 2016 12:56:26 -0700 |
| |
On 6/24/2016 12:15 PM, Paul Moore wrote: > On Thu, Jun 23, 2016 at 5:11 PM, Casey Schaufler <casey@schaufler-ca.com> wrote: >> Subject: [PATCH v4 3/3] LSM: Add context interface for proc attrs >> >> The /proc/.../attr/current interface is used by all three >> Linux security modules (SELinux, Smack and AppArmor) to >> report and modify the process security attribute. This is >> all fine when there is exactly one of these modules active >> and the userspace code knows which it module it is. >> It would require a major change to the "current" interface >> to provide information about more than one set of process >> security attributes. Instead, a "context" attribute is >> added, which identifies the security module that the >> information applies to. The format is: >> >> lsmname='context-value' >> >> When multiple concurrent modules are supported the >> /proc/.../attr/context interface will include the data >> for all of the active modules. >> >> lsmname1='context-value1'lsmname2='context-value2' >> >> The module specific subdirectories under attr contain context >> entries that report the information for that specific module >> in the same format. > I think a delimiter between the different LSMs would be a good idea. > A comma seems like a safe choice at the moment.
It's unnecessary and makes for more complicated code in both directions, but everyone seems wedded to a delimiter. I'll propose a v5 with a delimiter.
>
| |