lkml.org 
[lkml]   [2013]   [Jul]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH v14 5/6] LSM: SO_PEERSEC configuration options
Date
On Wednesday, July 31, 2013 08:45:52 AM Casey Schaufler wrote:
> On 7/30/2013 2:47 PM, Paul Moore wrote:
> > On Thursday, July 25, 2013 11:32:23 AM Casey Schaufler wrote:
> >> Subject: [PATCH v14 5/6] LSM: SO_PEERSEC configuration options
> >>
> >> Refine the handling of SO_PEERSEC to enable legacy
> >> user space runtimes, Fedora in particular, when running
> >> with multiple LSMs that are capable of providing information
> >> using getsockopt(). This introduces an additional configuration
> >> option, and requires that the default be the legacy behavior.
> >>
> >> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
> >
> > ...
> >
> >> --- a/security/Kconfig
> >> +++ b/security/Kconfig
> >> @@ -157,17 +157,49 @@ config SECMARK_LSM
> >>
> >> help
> >>
> >> The name of the LSM to use with the networking secmark
> >>
> >> -config SECURITY_PLAIN_CONTEXT
> >> - bool "Backward compatable contexts without lsm='value' formatting"
> >> - depends on SECURITY_SELINUX || SECURITY_SMACK
> >> - default y
> >> +choice
> >> + depends on SECURITY && (SECURITY_SELINUX || SECURITY_SMACK)
> >> + prompt "Peersec LSM"
> >> + default PEERSEC_SECURITY_FIRST
> >> +
> >>
> >> help
> >>
> >> - Without this value set security context strings will
> >> - include the name of the lsm with which they are associated
> >> - even if there is only one LSM that uses security contexts.
> >> - This matches the way contexts were handled before it was
> >> - possible to have multiple concurrent security modules.
> >> - If you are unsure how to answer this question, answer Y.
> >> + Select the security module that will send attribute
> >> + information in IP header options.
> >> + Most SELinux configurations do not take advantage
> >> + of Netlabel, while all Smack configurations do. Unless
> >> + there is a need to do otherwise chose Smack in preference
> >> + to SELinux.
> >
> > I'm not hugely in love with the help text; the first sentence seems to be
> > all that is needed, the second seems unnecessary and not exactly fair to
> > the LSMs.
>
> I can take out the "friendly advice". What it really should say
> is more on the lines of:
>
> If you have gotten to the point where you have to make
> this decision you should probably call it a work day, go
> home, have a nice drink and spend some time with a loved
> one. In the morning take a good hard look at your network
> configuration. You may end up with a different security
> policies being enforced with IPv4 and IPv6 communications.

Perfect ;)

--
paul moore
www.paul-moore.com



\
 
 \ /
  Last update: 2013-07-31 20:21    [W:0.083 / U:1.644 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site