Re: [PATCH] selinux: add selinux_is_enforced() function

From	Sebastien Buisson <sbuisson.ddn@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] selinux: add selinux_is_enforced() function
Date	2017-04-12 17:20 +0200
Message-ID	<tvsdP-64C-13@gated-at.bofh.it> (permalink)
References	<tvmrM-2Do-29@gated-at.bofh.it> <tvp6h-3Zp-11@gated-at.bofh.it> <tvqF4-51n-31@gated-at.bofh.it> <tvrB9-5Bn-33@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

2017-04-12 16:35 GMT+02:00 Stephen Smalley <sds@tycho.nsa.gov>:
> How are you using this SELinux information in the kernel and/or in
> userspace?  What's the purpose of it?  What are you comparing it
> against?  Why do you care if it changes?

Enforcement status and policy version are compared to their previously
stored value. If they differ, then it means we need to call a userland
helper from Lustre client kernelspace to read the currently loaded
policy (reading it will let us know if the Lustre client node is
conforming to the Lustre-wide security policy).
As calling the userland helper is costly, we do it only when it is
necessary by retrieving some SELinux key information directly from
kernelspace.

> Note btw that the notion of a policy name/type and the policy file path
> is purely a userspace construct and shouldn't be embedded in your
> kernel code.  Android for example doesn't follow that convention at
> all; their SELinux policy file is simply /sepolicy.  On modern kernels,
> you can always read the currently loaded policy from the kernel itself
> via /sys/fs/selinux/policy (formerly just /selinux/policy).

As I understand it, a userspace program can directly read the policy
info exposed by the kernel by reading this file. But how about reading
it from kernelspace?

Thread

[PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 11:10 +0200
  Re: [PATCH] selinux: add selinux_is_enforced() function Paul Moore <pmoore@redhat.com> - 2017-04-12 14:00 +0200
    Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 15:40 +0200
      Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 16:40 +0200
        Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 17:20 +0200
          Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 18:30 +0200
            Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 19:10 +0200
              Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 19:30 +0200
    Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 15:40 +0200
      Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 16:00 +0200
        Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 17:30 +0200
          Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 18:30 +0200
            Re: [PATCH] selinux: add selinux_is_enforced() function Casey Schaufler <casey@schaufler-ca.com> - 2017-04-13 02:20 +0200
  Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 14:10 +0200

csiph-web