lkml.org 
[lkml]   [2018]   [Feb]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH bpf-next v8 05/11] seccomp,landlock: Enforce Landlock programs per process hierarchy
    On Tue, Feb 27, 2018 at 5:30 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
    > On 2/27/2018 8:39 AM, Andy Lutomirski wrote:
    >> On Tue, Feb 27, 2018 at 5:32 AM, Alexei Starovoitov
    >> <alexei.starovoitov@gmail.com> wrote:
    >>> [ Snip ]
    >> An earlier version of the patch set used the seccomp filter chain.
    >> Mickaël, what exactly was wrong with that approach other than that the
    >> seccomp() syscall was awkward for you to use? You could add a
    >> seccomp_add_landlock_rule() syscall if you needed to.
    >>
    >> As a side comment, why is this an LSM at all, let alone a non-stacking
    >> LSM? It would make a lot more sense to me to make Landlock depend on
    >> having LSMs configured in but to call the landlock hooks directly from
    >> the security_xyz() hooks.
    >
    > Please, no. It is my serious intention to have at least the
    > infrastructure blob management in within a release or two, and
    > I think that's all Landlock needs. The security_xyz() hooks are
    > sufficiently hackish as it is without unnecessarily adding more
    > special cases.
    >
    >

    What do you mean by "infrastructure blob management"?

    \
     
     \ /
      Last update: 2018-02-27 18:38    [W:7.547 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site