Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1372987 > unrolled thread
| Started by | Kees Cook <keescook@chromium.org> |
|---|---|
| First post | 2016-04-07 02:30 +0200 |
| Last post | 2016-04-12 19:00 +0200 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH v3 0/6] LSM: LoadPin for kernel file loading restrictions Kees Cook <keescook@chromium.org> - 2016-04-07 02:30 +0200
Re: [PATCH v3 0/6] LSM: LoadPin for kernel file loading restrictions James Morris <jmorris@namei.org> - 2016-04-12 12:10 +0200
Re: [PATCH v3 0/6] LSM: LoadPin for kernel file loading restrictions Kees Cook <keescook@chromium.org> - 2016-04-12 19:00 +0200
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-04-07 02:30 +0200 |
| Subject | [PATCH v3 0/6] LSM: LoadPin for kernel file loading restrictions |
| Message-ID | <rl5ZD-3Ja-3@gated-at.bofh.it> |
This provides the mini-LSM "loadpin" that intercepts the now consolidated kernel_file_read LSM hook so that a system can keep all loads coming from a single trusted filesystem. This is what Chrome OS uses to pin kernel module and firmware loading to the read-only crypto-verified dm-verity partition so that kernel module signing is not needed. -Kees v3: - changed module parameter to "loadpin.enabled" - add sysctl docs, akpm - add general use function for enum, zohar - add gfp_t, joe - clean up loops, andriy.shevchenko - reduce BUG_ON to WARN_ON, joe v2: - break out utility helpers into separate functions - have Yama use new helpers too
[toc] | [next] | [standalone]
| From | James Morris <jmorris@namei.org> |
|---|---|
| Date | 2016-04-12 12:10 +0200 |
| Subject | Re: [PATCH v3 0/6] LSM: LoadPin for kernel file loading restrictions |
| Message-ID | <rn3qG-5Df-23@gated-at.bofh.it> |
| In reply to | #1372987 |
On Wed, 6 Apr 2016, Kees Cook wrote: > This provides the mini-LSM "loadpin" that intercepts the now consolidated > kernel_file_read LSM hook so that a system can keep all loads coming from > a single trusted filesystem. This is what Chrome OS uses to pin kernel > module and firmware loading to the read-only crypto-verified dm-verity > partition so that kernel module signing is not needed. > This all looks good to me, just waiting now for the const fix suggested by Joe. -- James Morris <jmorris@namei.org>
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-04-12 19:00 +0200 |
| Message-ID | <rn9Ps-27p-11@gated-at.bofh.it> |
| In reply to | #1376616 |
On Tue, Apr 12, 2016 at 2:59 AM, James Morris <jmorris@namei.org> wrote: > On Wed, 6 Apr 2016, Kees Cook wrote: > >> This provides the mini-LSM "loadpin" that intercepts the now consolidated >> kernel_file_read LSM hook so that a system can keep all loads coming from >> a single trusted filesystem. This is what Chrome OS uses to pin kernel >> module and firmware loading to the read-only crypto-verified dm-verity >> partition so that kernel module signing is not needed. >> > > This all looks good to me, just waiting now for the const fix suggested by > Joe. Okay, great, thanks! I've sent a v4 with the const change now. -Kees -- Kees Cook Chrome OS & Brillo Security
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web