Re: [RFC 0/3] WhiteEgret LSM module

From	Casey Schaufler <casey@schaufler-ca.com>
Newsgroups	linux.kernel
Subject	Re: [RFC 0/3] WhiteEgret LSM module
Date	2017-06-02 21:10 +0200
Message-ID	<tO07o-5bS-19@gated-at.bofh.it> (permalink)
References	<tMNYC-6Sw-15@gated-at.bofh.it> <tMWIx-43x-3@gated-at.bofh.it> <tN9w5-3Ek-3@gated-at.bofh.it> <tNdJp-6BP-27@gated-at.bofh.it> <tNYIi-4cS-15@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 6/2/2017 10:39 AM, Steve Kemp wrote:
>> Create an security module that looks for the attribute
> For what it is worth I thought this seemed like an interesting project
> for a beginner, so I did just that.  I wrote up the experience here:
>
> https://blog.steve.fi/so_i_accidentally_wrote_a_linux_security_module.html
>
> In short it was a very simple and clean approach, which I think is
> hard to get wrong.  The only part I need to work on some more is the
> difference between `user` and `security` attributes.

A 'user' attribute can be set by the file owner. A 'security'
attribute requires privilege. SELinux and Smack use 'security'
attributes to prevent users from mucking with them. You need
to create module hooks for manipulating them, including

	inode_init_security
	inode_setxattr
	inode_post_setxattr
	inode_removexattr
	inode_getsecurity
	inode_listsecurity
	inode_setsecurity
	d_instantiate



>
> Steve
> --
> https://steve.fi/
>

Thread

[RFC 0/3] WhiteEgret LSM module Masanobu Koike <masanobu2.koike@toshiba.co.jp> - 2017-05-30 14:00 +0200
  Re: [RFC 0/3] WhiteEgret LSM module Casey Schaufler <casey@schaufler-ca.com> - 2017-05-30 19:20 +0200
    RE: [RFC 0/3] WhiteEgret LSM module <masanobu2.koike@toshiba.co.jp> - 2017-06-06 11:30 +0200
  Re: [RFC 0/3] WhiteEgret LSM module Matthew Garrett <mjg59@google.com> - 2017-05-30 23:20 +0200
    Re: [RFC 0/3] WhiteEgret LSM module Peter Dolding <oiaohm@gmail.com> - 2017-05-31 13:00 +0200
      Re: [RFC 0/3] WhiteEgret LSM module Casey Schaufler <casey@schaufler-ca.com> - 2017-05-31 17:30 +0200
        Re: [RFC 0/3] WhiteEgret LSM module "Serge E. Hallyn" <serge@hallyn.com> - 2017-05-31 17:40 +0200
          Re: [RFC 0/3] WhiteEgret LSM module Peter Dolding <oiaohm@gmail.com> - 2017-06-04 04:50 +0200
            Re: [RFC 0/3] WhiteEgret LSM module "Serge E. Hallyn" <serge@hallyn.com> - 2017-06-04 18:30 +0200
        Re: [RFC 0/3] WhiteEgret LSM module Steve Kemp <steve.backup.kemp@googlemail.com> - 2017-06-02 19:40 +0200
          Re: [RFC 0/3] WhiteEgret LSM module Casey Schaufler <casey@schaufler-ca.com> - 2017-06-02 21:10 +0200
            Re: [RFC 0/3] WhiteEgret LSM module Steve Kemp <steve.backup.kemp@googlemail.com> - 2017-06-02 22:30 +0200
      Re: [RFC 0/3] WhiteEgret LSM module Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> - 2017-05-31 17:40 +0200
        Re: [RFC 0/3] WhiteEgret LSM module Peter Dolding <oiaohm@gmail.com> - 2017-06-04 04:30 +0200
          Re: [RFC 0/3] WhiteEgret LSM module Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> - 2017-06-04 21:00 +0200
    RE: [RFC 0/3] WhiteEgret LSM module <masanobu2.koike@toshiba.co.jp> - 2017-06-01 14:40 +0200

csiph-web