lkml.org 
[lkml]   [2010]   [Jul]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 0/2] Yama: add PTRACE exception tracking
From
Date
On Thu, 2010-07-01 at 14:41 -0500, Serge E. Hallyn wrote:
> Quoting Kees Cook (kees.cook@canonical.com):
> > > > I still think simple chaining is the way to go. I want to review the
> > > > earlier discussions first (I think Serge said it was in 2004ish?) before I
> > > > write up anything. There is, I think, one sticking point, which is
> > > > /proc/self/attr/current, but beyond that, I think some simple
> > > > reorganization of LSM initialization routines and a list that security_*
> > > > walks would be sufficient.
> > >
> > > In the past, output results for each LSM were simply split by \n or a :
> > > or something, and input was prepended by the LSM name.
> >
> > This doesn't appear to be true anymore. Looking at the fs/proc/base.c and
> > security/selinux/hooks.c code, there is no checking for a prepended LSM
> > name. Maybe that's the first chaining limitation -- you can't chain 2 LSMs
> > that both declare setprocattr hooks.
>
> No no, Stephen and I were talking about in the stacker patchset, again
> around 2004-2005. Never went upstream (per 2005 or 2006 ksummit
> agreement).

Patch series was also available from:
http://sourceforge.net/projects/lsm-stacker/files/

Looks like it was last updated in 2006.

--
Stephen Smalley
National Security Agency



\
 
 \ /
  Last update: 2010-07-01 22:01    [W:0.092 / U:0.160 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site