lkml.org 
[lkml]   [2015]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 0/7 v22] LSM: Multiple concurrent LSMs
    On 5/8/2015 4:21 AM, Mimi Zohar wrote:
    > On Thu, 2015-05-07 at 13:36 -0700, Casey Schaufler wrote:
    >> On 5/7/2015 1:23 PM, Stephen Smalley wrote:
    >>> On 05/07/2015 04:22 PM, Mimi Zohar wrote:
    >>>> On Thu, 2015-05-07 at 14:07 -0400, Paul Moore wrote:
    >>>>> On Thu, May 7, 2015 at 10:47 AM, Casey Schaufler <casey@schaufler-ca.com> wrote:
    >>>>>> On 5/7/2015 4:37 AM, James Morris wrote:
    >>>>>>> On Sat, 2 May 2015, Casey Schaufler wrote:
    >>>>>>>
    >>>>>>>> Subject: [PATCH 0/7 v22] LSM: Multiple concurrent LSMs
    >>>>>>> Please add all of the Acked-by etc. from the patch review process.
    >>>>>> For v21 I had Acks from:
    >>>>>>
    >>>>>> John Johansen <john.johansen@canonical.com>
    >>>>>> Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    >>>>>> Stephen Smalley <sds@tycho.nsa.gov> (after patch 8/7)
    >>>>>> Kees Cook <keescook@chromium.org>
    >>>>>>
    >>>>>> Would you check out v22 and supply (or not) your Acks?
    >>>>>>
    >>>>>> Eric, Paul, it would be reassuring if you'd chime in as well.
    >>>>> Kubernetes has swallowed Eric whole I'm afraid, I don't think you want
    >>>>> to wait on him to review these patches.
    >>>>>
    >>>>> However, it is a bit ridiculous that I haven't had time to seriously
    >>>>> review these patches yet; I promise to take a look and send my
    >>>>> comments/ACKs before my head hits the pillow tonight.
    >>>> Seems to be working with SELinux, EVM and IMA enabled. I haven't tried
    >>>> enabling an additional LSM. Casey, do you have an additional LSM for
    >>>> testing?
    >>> I've tested SELinux+Yama.
    >> The deepest "stack" you can have today is Capability+Yama+YourChoice.
    >> You always get Capability, so you really only get to choose if you stack
    >> Yama with something else. That's not more depth than you had before, but
    >> the special case coding for Capability and Yama is replaced to the general
    >> scheme.
    > Nice cleanup! I assume this will pave the way for other small, builtin
    > LSMs. :)
    >
    > I'm now running with Yama as well. While enabling Yama, I noticed a
    > very minor issue with security/Kconfig. It permits defining Yama as the
    > default LSM when it is stacked.

    You don't get Yama called twice in that case, which would be
    the primary concern. I have maintained the existing behavior,
    I think. The Yama special case stacking will go away when the
    general LSM list specification mechanism ("yama,apparmor") comes
    in. That ought to be in the next round.

    >
    > Mimi
    >
    > --
    > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
    > the body of a message to majordomo@vger.kernel.org
    > More majordomo info at http://vger.kernel.org/majordomo-info.html
    >



    \
     
     \ /
      Last update: 2015-05-08 18:21    [W:3.227 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site