From: Konstantin Andreev <andreev@swemel.ru>
To: Casey Schaufler <casey@schaufler-ca.com>, paul@paul-moore.com
Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org
Subject: Re: [PATCH v3 01/13] LSM: Add the lsm_prop data structure.
Date: Fri, 13 Sep 2024 23:49:38 +0300 [thread overview]
Message-ID: <2e1da617-c437-4ff9-93e0-e0e212aabfaa@swemel.ru> (raw)
In-Reply-To: <20240910184125.224651-2-casey@schaufler-ca.com>
Casey Schaufler, 10 Sep 2024:
> ...
> The lsm_prop structure definition is intended to keep the LSM
> specific information private to the individual security modules.
> ...
> index 1390f1efb4f0..1027c802cc8c 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -140,6 +144,22 @@ enum lockdown_reason {
> +
> +/*
> + * Data exported by the security modules
> + */
> +struct lsm_prop {
> + struct lsm_prop_selinux selinux;
> + struct lsm_prop_smack smack;
> + struct lsm_prop_apparmor apparmor;
> + struct lsm_prop_bpf bpf;
> + struct lsm_prop_scaffold scaffold;
> +};
This design prevents compiling and loading out-of-tree 3rd party LSM, am I right?
Out-of-tree LSM's were discussed recently at
https://lore.kernel.org/linux-security-module/efb8f264-f80e-43b2-8ea3-fcc9789520ec@I-love.SAKURA.ne.jp/T/
https://lore.kernel.org/linux-security-module/960e740f-e5d9-409b-bb2a-8bdceffaae95@I-love.SAKURA.ne.jp/T/
but it looks like a final decision to ban them is not taken yet.
--
Konstantin Andreev
next prev parent reply other threads:[~2024-09-13 20:49 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20240910184125.224651-1-casey.ref@schaufler-ca.com>
2024-09-10 18:41 ` [PATCH v3 00/13] LSM: Move away from secids Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 01/13] LSM: Add the lsm_prop data structure Casey Schaufler
2024-09-13 20:49 ` Konstantin Andreev [this message]
2024-09-13 21:45 ` Paul Moore
2024-09-14 11:00 ` Konstantin Andreev
2024-09-13 23:05 ` Casey Schaufler
2024-09-14 10:30 ` Konstantin Andreev
2024-09-14 13:40 ` Tetsuo Handa
2024-09-14 15:05 ` Tetsuo Handa
2024-09-10 18:41 ` [PATCH v3 02/13] LSM: Use lsm_prop in security_audit_rule_match Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 03/13] LSM: Add lsmprop_to_secctx hook Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 04/13] Audit: maintain an lsm_prop in audit_context Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 05/13] LSM: Use lsm_prop in security_ipc_getsecid Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 06/13] Audit: Update shutdown LSM data Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 07/13] LSM: Use lsm_prop in security_current_getsecid Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 08/13] LSM: Use lsm_prop in security_inode_getsecid Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 09/13] Audit: use an lsm_prop in audit_names Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 10/13] LSM: Create new security_cred_getlsmprop LSM hook Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 11/13] Audit: Change context data from secid to lsm_prop Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 12/13] Use lsm_prop for audit data Casey Schaufler
2024-09-10 18:41 ` [PATCH v3 13/13] LSM: Remove lsm_prop scaffolding Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2e1da617-c437-4ff9-93e0-e0e212aabfaa@swemel.ru \
--to=andreev@swemel.ru \
--cc=casey@schaufler-ca.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®