From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751937AbdF1I3K (ORCPT <rfc822;w@1wt.eu>);
        Wed, 28 Jun 2017 04:29:10 -0400
Received: from lhrrgout.huawei.com ([194.213.3.17]:29617 "EHLO
        lhrrgout.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751827AbdF1I2o (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 28 Jun 2017 04:28:44 -0400
Subject: Re: [PATCH 3/3] Make LSM Writable Hooks a command line option
To: Christoph Hellwig <hch@infradead.org>
CC: <keescook@chromium.org>, <mhocko@kernel.org>, <jmorris@namei.org>,
        <penguin-kernel@I-love.SAKURA.ne.jp>, <paul@paul-moore.com>,
        <sds@tycho.nsa.gov>, <casey@schaufler-ca.com>, <labbott@redhat.com>,
        <linux-security-module@vger.kernel.org>, <linux-mm@kvack.org>,
        <linux-kernel@vger.kernel.org>, <kernel-hardening@lists.openwall.com>,
        "Igor Stoppa" <igor.stoppa@gmail.com>
References: <20170627173323.11287-1-igor.stoppa@huawei.com>
 <20170627173323.11287-4-igor.stoppa@huawei.com>
 <20170627175118.GA14286@infradead.org>
From: Igor Stoppa <igor.stoppa@huawei.com>
Message-ID: <bd570517-c05f-7f37-aba0-6e4c14938dfb@huawei.com>
Date: Wed, 28 Jun 2017 11:25:37 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.1.1
MIME-Version: 1.0
In-Reply-To: <20170627175118.GA14286@infradead.org>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-Originating-IP: [10.122.225.51]
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0),
        refid=str=0001.0A020206.59536889.0057,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0,
        ip=0.0.0.0,
        so=2013-06-18 04:22:30,
        dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: a203343fa591d285be33608bd6f568d3
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Resending my reply, I mistakenly used the wrong mail account yesterday
and my reply didn't et to the ml.

On 27/06/17 20:51, Christoph Hellwig wrote:
> On Tue, Jun 27, 2017 at 08:33:23PM +0300, Igor Stoppa wrote:

[...]

>> The default value is disabled, unless SE Linux debugging is turned on.
> 
> Can we please just force it to be read-only?

I'm sorry, I'm not quite sure I understand your comment.

I'm trying to replicate the behavior of __lsm_ro_after_init:

line 1967 @ [1]   - Did I get it wrong?

thanks, igor



[1]
https://kernel.googlesource.com/pub/scm/linux/kernel/git/jmorris/linux-security/+/5965453d5e3fb425e6f9d6b4fec403bda3f33107/include/linux/lsm_hooks.h