From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933278AbcGEPwi (ORCPT ); Tue, 5 Jul 2016 11:52:38 -0400 Received: from nm37-vm8.bullet.mail.bf1.yahoo.com ([72.30.238.220]:55656 "EHLO nm37-vm8.bullet.mail.bf1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933044AbcGEPwc (ORCPT ); Tue, 5 Jul 2016 11:52:32 -0400 X-Yahoo-Newman-Id: 717505.2784.bm@smtp219.mail.bf1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: ajLKI3sVM1lyKoGSv_I8C2yDuSTokwbT8.o_RQ.jtKWSlJH PMqmG3V7piD7D_kUF1D9WbzTqGtWRYBFuwe9nYhlHHw2XYK7bHffEzfKA772 xutjbsAln0FdCp4NitdepThNkOsuuEvLHpXhKILyFSjrwujje9QfxIl6GomZ pfd_n7ntkZPcL0xUIUxjPaoXkCCIqzhr8a2_Pb0MMmSVPIVXFGG1tXGCenCX rumQ_unHQsLOsKsFUigtA4O86kmqdDH6HxHIcjqRKN44lDtiCX1ZxsO8wIkp ftNOGcdI6WrnZzTrd98f3tX5LJ5mpNL5ukqF1QyKFcH.GuZepNcFoErIi_Mb d3_XvceoPaBS4P1OhPWzQQ8yqsasXN_1NAU5vprJPoVARePaEpTk0ijwuDUO 28CaQKLxJON8kWduMDj5I2.7p_7MgYzVvv_BhrcaLTr9JK.3N2bj3Cn0VUx2 UTYngYgfYXswyWofhv7NJpxA9EuKPS4a4beYzw6yQ3N1AWhTCFfQoMEFHWau sxZe_3OymlNos1X6LCLC33O5QSzgATSnoN3XsaxBkSeMyHbhymxY- X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- Subject: [PATCH v5 0/3] LSM: security module information improvements - Acked References: <599d0a80-0838-2baa-8ee2-7eefafc10cec@schaufler-ca.com> <4263259c-7fc4-58e4-a86d-7ba92abe510a@schaufler-ca.com> <587c9d63-bd39-5781-a7b6-6add2f63c72e@schaufler-ca.com> <56dc3195-dccb-cd2d-0de0-320f9c4b3672@schaufler-ca.com> <5777F90A.6000609@canonical.com> Cc: John Johansen , Paul Moore , Kees Cook , Stephen Smalley , Tetsuo Handa , LKLM To: LSM , James Morris From: Casey Schaufler Message-ID: Date: Tue, 5 Jul 2016 08:52:25 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <5777F90A.6000609@canonical.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Subject: [PATCH v5 0/3] LSM: security module information improvements I have added Acks. James, would you like me to add this to the Smack tree? Changes from v4: Use kasprintf instead of kzalloc() ... sprintf in more places. More in the documentation. Separate module information in contexts with ",". (not yet visible) Changes from v3: Use kasprintf instead of kzalloc() ... sprintf. Create interfaces that make it possible to deal with process attributes in the face of multiple "major" security modules. Patch 1/3 adds /sys/kernel/security/lsm, which provides a list of the active security modules on the system. $ cat /sys/kernel/security/lsm capability,yama,loadpin,smack Patch 2/3 adds a subdirectory in /proc/.../attr for each security module that exports process attribute data. This allows a program in easily differentiate between the "current" value for Smack and AppArmor. $ cat /proc/self/attr/smack/current System $ cat /proc/self/attr/apparmor/current unconfined Patch 3/3 adds an interface that provides module identified information that otherwise matches the "current" attr. This allows a system with multiple modules to provide the complete security "context" in one place. A (future) system with both Smack and AppArmor might report: $ cat /proc/self/attr/context smack='System',apparmor='unconfined' Signed-off-by: Casey Schaufler Acked-by: John Johansen Acked-by: Paul Moore Acked-by: Kees Cook --- Documentation/security/LSM.txt | 34 ++++++-- fs/proc/base.c | 95 +++++++++++++++++++--- fs/proc/internal.h | 1 + include/linux/lsm_hooks.h | 12 +-- include/linux/security.h | 15 ++-- security/apparmor/lsm.c | 38 +++++++-- security/commoncap.c | 3 +- security/inode.c | 26 +++++- security/loadpin/loadpin.c | 2 +- security/security.c | 177 ++++++++++++++++++++++++++++++++++++++++- security/selinux/hooks.c | 22 ++++- security/smack/smack_lsm.c | 22 ++--- security/tomoyo/tomoyo.c | 2 +- security/yama/yama_lsm.c | 2 +- 14 files changed, 395 insertions(+), 56 deletions(-)