From: "Reshetova, Elena" <elena.reshetova@intel.com>
To: "sargun@sargun.me" <sargun@sargun.me>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>,
Daniel Borkmann <daniel@iogearbox.net>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: RE: [RFC 3/4] security/checmate: Add Checmate sample
Date: Fri, 5 Aug 2016 11:10:37 +0000 [thread overview]
Message-ID: <2236FBA76BA1254E88B949DDB74E612B41B72014@IRSMSX102.ger.corp.intel.com> (raw)
In-Reply-To: <CALrft9_WUBK=A3h7h+ePutO_qKvQEqXxmSd+7f8gNk6FWDAVOA@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 726 bytes --]
Sorry have to resend from normal mail client due to gmail stupid interface. I
am not able to find plain text button anywhere anymore...
>On Fri, 5 Aug 2016 at 13:49 Elena Reshetova <elena.reshetova@gmail.com>
>wrote:
>The Checmate sample installs a policy barring new AF_INET connections
>to port 1. We install the hook, and show an example of connect
>returning EPERM, and then reset the policy.
Could you actually provide a more complex example, where you actually need to
share a state between different hooks?
Even minor LSMs need to keep internal info in one way or another to make
useful decisions. Like Yama needs to track ptrace info, Hardchroot would need
to track if process is inside chroot or not and etc.
[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 7586 bytes --]
prev parent reply other threads:[~2016-08-05 11:10 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-04 7:11 Sargun Dhillon
[not found] ` <CALrft9_ik8PWRjH1yOLZUWKkZnpMm5R0BHX27C+NLU=n0C9vDA@mail.gmail.com>
[not found] ` <CALrft9_WUBK=A3h7h+ePutO_qKvQEqXxmSd+7f8gNk6FWDAVOA@mail.gmail.com>
2016-08-05 11:10 ` Reshetova, Elena [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2236FBA76BA1254E88B949DDB74E612B41B72014@IRSMSX102.ger.corp.intel.com \
--to=elena.reshetova@intel.com \
--cc=alexei.starovoitov@gmail.com \
--cc=daniel@iogearbox.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sargun@sargun.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®