Re: [RFC 0/3] WhiteEgret LSM module

From	"Serge E. Hallyn" <serge@hallyn.com>
Newsgroups	linux.kernel
Subject	Re: [RFC 0/3] WhiteEgret LSM module
Date	2017-05-31 17:40 +0200
Message-ID	<tNdT4-6EZ-17@gated-at.bofh.it> (permalink)
References	<tMNYC-6Sw-15@gated-at.bofh.it> <tMWIx-43x-3@gated-at.bofh.it> <tN9w5-3Ek-3@gated-at.bofh.it> <tNdJp-6BP-27@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Quoting Casey Schaufler (casey@schaufler-ca.com):
> 
> 
> On 5/31/2017 3:59 AM, Peter Dolding wrote:
> > ...
> >
> > Like you see here in Australian government policy there is another
> > thing called whitelisted.
> > https://www.asd.gov.au/publications/protect/top_4_mitigations_linux.htm
> > Matthew Garrett you might want to call IMA whitelisting Australian
> > government for one does not agree.  IMA is signed.   The difference
> > between signed and white-listed is you might have signed a lot more
> > than what a particular system is white-listed to allowed used.
> >
> To be clear, I'm all for a security module to support this policy.
> As the explicit requirement is for a whitelist, as opposed to allowing
> for a properly configured system*, you can't use any of the existing
> technologies to meet it. This kind of thing** is why we have a LSM
> infrastructure.
> 
> Unfortunately, the implementation proposed has very serious issues.
> You can't do access control from userspace. You can't count on
> identifying programs strictly by pathname. It's much more complicated
> than it needs to be for the task.
> 
> Suggestion:
> 
> Create an security module that looks for the attribute
> 
> 	security.WHITELISTED

Bonus, you can have EVM verify the validity of these xattrs, and
IMA verify the interity of the file itself.

Thread

[RFC 0/3] WhiteEgret LSM module Masanobu Koike <masanobu2.koike@toshiba.co.jp> - 2017-05-30 14:00 +0200
  Re: [RFC 0/3] WhiteEgret LSM module Casey Schaufler <casey@schaufler-ca.com> - 2017-05-30 19:20 +0200
    RE: [RFC 0/3] WhiteEgret LSM module <masanobu2.koike@toshiba.co.jp> - 2017-06-06 11:30 +0200
  Re: [RFC 0/3] WhiteEgret LSM module Matthew Garrett <mjg59@google.com> - 2017-05-30 23:20 +0200
    Re: [RFC 0/3] WhiteEgret LSM module Peter Dolding <oiaohm@gmail.com> - 2017-05-31 13:00 +0200
      Re: [RFC 0/3] WhiteEgret LSM module Casey Schaufler <casey@schaufler-ca.com> - 2017-05-31 17:30 +0200
        Re: [RFC 0/3] WhiteEgret LSM module "Serge E. Hallyn" <serge@hallyn.com> - 2017-05-31 17:40 +0200
          Re: [RFC 0/3] WhiteEgret LSM module Peter Dolding <oiaohm@gmail.com> - 2017-06-04 04:50 +0200
            Re: [RFC 0/3] WhiteEgret LSM module "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-04 18:30 +0200
        Re: [RFC 0/3] WhiteEgret LSM module Steve Kemp <steve.backup.kemp@googlemail.com> - 2017-06-02 19:40 +0200
          Re: [RFC 0/3] WhiteEgret LSM module Casey Schaufler <casey@schaufler-ca.com> - 2017-06-02 21:10 +0200
            Re: [RFC 0/3] WhiteEgret LSM module Steve Kemp <steve.backup.kemp@googlemail.com> - 2017-06-02 22:30 +0200
      Re: [RFC 0/3] WhiteEgret LSM module Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> - 2017-05-31 17:40 +0200
        Re: [RFC 0/3] WhiteEgret LSM module Peter Dolding <oiaohm@gmail.com> - 2017-06-04 04:30 +0200
          Re: [RFC 0/3] WhiteEgret LSM module Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> - 2017-06-04 21:00 +0200
    RE: [RFC 0/3] WhiteEgret LSM module <masanobu2.koike@toshiba.co.jp> - 2017-06-01 14:40 +0200

csiph-web