Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1622300
| From | Stephen Smalley <sds@tycho.nsa.gov> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH] selinux: add selinux_is_enforced() function |
| Date | 2017-04-12 18:30 +0200 |
| Message-ID | <tvtjA-6IX-27@gated-at.bofh.it> (permalink) |
| References | <tvmrM-2Do-29@gated-at.bofh.it> <tvp6h-3Zp-11@gated-at.bofh.it> <tvqF4-51n-37@gated-at.bofh.it> <tvqYp-58l-1@gated-at.bofh.it> <tvsnw-680-11@gated-at.bofh.it> |
| Organization | National Security Agency |
On Wed, 2017-04-12 at 17:19 +0200, Sebastien Buisson wrote: > 2017-04-12 15:58 GMT+02:00 Stephen Smalley <sds@tycho.nsa.gov>: > > Even your usage of selinux_is_enabled() looks suspect; that should > > probably go away. Only other user of it seems to be some cred > > validity > > checking that could be dropped as well. > > Well the main reason for calling selinux_is_enabled() is performance > optimization. > Should I propose a patch to add a new security_is_enabled() function > at the LSM abstraction layer? Or do you consider we should not test > security enabled at all? It isn't clear what "is enabled" means in general, particularly with stacking. I would either drop it or replace it with a LSM hook that is more precise. For example, NFSv4 introduced a security_ismaclabel() hook so that it could test whether a given security.* xattr is a MAC label.
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 11:10 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Paul Moore <pmoore@redhat.com> - 2017-04-12 14:00 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 15:40 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 16:40 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 17:20 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 18:30 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 19:10 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 19:30 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 15:40 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 16:00 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-04-12 17:30 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 18:30 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Casey Schaufler <casey@schaufler-ca.com> - 2017-04-13 02:20 +0200
Re: [PATCH] selinux: add selinux_is_enforced() function Stephen Smalley <sds@tycho.nsa.gov> - 2017-04-12 14:10 +0200
csiph-web