From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751190AbdEaPfq (ORCPT ); Wed, 31 May 2017 11:35:46 -0400 Received: from h2.hallyn.com ([78.46.35.8]:45100 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750998AbdEaPfp (ORCPT ); Wed, 31 May 2017 11:35:45 -0400 Date: Wed, 31 May 2017 10:35:49 -0500 From: "Serge E. Hallyn" To: Casey Schaufler Cc: Peter Dolding , Matthew Garrett , Masanobu Koike , james.l.morris@oracle.com, "Serge E. Hallyn" , linux-security-module , linux-kernel Subject: Re: [RFC 0/3] WhiteEgret LSM module Message-ID: <20170531153549.GB31189@mail.hallyn.com> References: <20170530111157.5196-1-masanobu2.koike@toshiba.co.jp> <20170530205002.GA9841@srcf.ucam.org> <0e0aa575-263a-893a-7ade-f2dc7ce679c2@schaufler-ca.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <0e0aa575-263a-893a-7ade-f2dc7ce679c2@schaufler-ca.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Casey Schaufler (casey@schaufler-ca.com): > > > On 5/31/2017 3:59 AM, Peter Dolding wrote: > > ... > > > > Like you see here in Australian government policy there is another > > thing called whitelisted. > > https://www.asd.gov.au/publications/protect/top_4_mitigations_linux.htm > > Matthew Garrett you might want to call IMA whitelisting Australian > > government for one does not agree. IMA is signed. The difference > > between signed and white-listed is you might have signed a lot more > > than what a particular system is white-listed to allowed used. > > > To be clear, I'm all for a security module to support this policy. > As the explicit requirement is for a whitelist, as opposed to allowing > for a properly configured system*, you can't use any of the existing > technologies to meet it. This kind of thing** is why we have a LSM > infrastructure. > > Unfortunately, the implementation proposed has very serious issues. > You can't do access control from userspace. You can't count on > identifying programs strictly by pathname. It's much more complicated > than it needs to be for the task. > > Suggestion: > > Create an security module that looks for the attribute > > security.WHITELISTED Bonus, you can have EVM verify the validity of these xattrs, and IMA verify the interity of the file itself.