Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1651862 > unrolled thread

[PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head

Back to article view | Back to linux.kernel

Contents

  [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-05-27 13:20 +0200
    Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head Casey Schaufler <casey@schaufler-ca.com> - 2017-05-28 00:40 +0200
      Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-05-28 02:40 +0200
    Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head Kees Cook <keescook@chromium.org> - 2017-05-28 03:10 +0200
      Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-05-28 03:30 +0200
        Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head Casey Schaufler <casey@schaufler-ca.com> - 2017-05-28 20:00 +0200
        Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head James Morris <jmorris@namei.org> - 2017-05-30 12:30 +0200
          Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-05-30 16:40 +0200
            Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-05-30 17:30 +0200
              Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head James Morris <jmorris@namei.org> - 2017-05-31 01:10 +0200
                Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-05-31 12:50 +0200
                  Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head James Morris <jmorris@namei.org> - 2017-05-31 13:10 +0200
                    Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-05-31 13:40 +0200
                  Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-05-31 16:50 +0200
                    Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-05-31 17:20 +0200
                      Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-05-31 17:20 +0200
            Re: [PATCH] LSM: Convert security_hook_heads into explicit array of  struct list_head José Bollo <jobol@nonadev.net> - 2017-05-31 12:00 +0200
    [PATCH v2] LSM: Convert security_hook_heads into explicit array of struct list_head Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-05-28 22:40 +0200
      Re: [PATCH v2] LSM: Convert security_hook_heads into explicit array  of struct list_head Kees Cook <keescook@chromium.org> - 2017-05-28 23:20 +0200
      Re: [PATCH v2] LSM: Convert security_hook_heads into explicit array  of struct list_head Casey Schaufler <casey@schaufler-ca.com> - 2017-05-29 19:40 +0200
      Re: [PATCH v2] LSM: Convert security_hook_heads into explicit array  of struct list_head James Morris <jmorris@namei.org> - 2017-05-30 12:40 +0200
        Re: [PATCH v2] LSM: Convert security_hook_heads into explicit array  of struct list_head Igor Stoppa <igor.stoppa@huawei.com> - 2017-05-31 23:00 +0200
          Re: [PATCH v2] LSM: Convert security_hook_heads into explicit array  of struct list_head James Morris <jmorris@namei.org> - 2017-06-01 01:00 +0200

Page 2 of 2 — ← Prev page 1 [2]

#1653093 — Re: [PATCH v2] LSM: Convert security_hook_heads into explicit array of struct list_head

On Mon, 29 May 2017, Tetsuo Handa wrote:

> Igor proposed a sealable memory allocator, and the LSM hooks
> ("struct security_hook_heads security_hook_heads" and
> "struct security_hook_list ...[]") will benefit from that allocator via
> protection using set_memory_ro()/set_memory_rw(), and that allocator
> will remove CONFIG_SECURITY_WRITABLE_HOOKS config option. Thus, we will
> likely be moving to that direction.
> 
> This means that these structures will be allocated at run time using
> that allocator, and therefore the address of these structures will be
> determined at run time rather than compile time.
> 
> But currently, LSM_HOOK_INIT() macro depends on the address of
> security_hook_heads being known at compile time. If we use an enum
> so that LSM_HOOK_INIT() macro does not need to know absolute address of
> security_hook_heads, it will help us to use that allocator for LSM hooks.
> 

This seems like pointless churn in security-critical code in anticipation 
of features which are still in development and may not be adopted.

Is there a compelling reason to merge this now? (And I don't mean worrying 
about non-existent compliers).



-- 
James Morris
<jmorris@namei.org>

[toc] | [prev] | [next] | [standalone]

#1654616 — Re: [PATCH v2] LSM: Convert security_hook_heads into explicit array of struct list_head

On 30/05/17 13:32, James Morris wrote:

> This seems like pointless churn in security-critical code in anticipation 
> of features which are still in development and may not be adopted.
> 
> Is there a compelling reason to merge this now? (And I don't mean worrying 
> about non-existent compliers).

I propose to take this patch as part of those I will be submitting.
It took me some unplanned time to add support for hardened user copy,
but now it's done - at least to a point that I can test it without failures.

So I'm back on track to provide an example of the smalloc api and I can
also use Tetsuo's work (thanks again, btw).
This patch would be sandwiched between the smalloc ones and the LSM rework.

It can get merged when the rest (hopefully) is merged.

But I have a more prosaic question: since smalloc is affecting the
memory subsystem, can it still be merged through the security tree?

---
thanks, igor

[toc] | [prev] | [next] | [standalone]

#1654713 — Re: [PATCH v2] LSM: Convert security_hook_heads into explicit array of struct list_head

On Wed, 31 May 2017, Igor Stoppa wrote:

> On 30/05/17 13:32, James Morris wrote:
> 
> > This seems like pointless churn in security-critical code in anticipation 
> > of features which are still in development and may not be adopted.
> > 
> > Is there a compelling reason to merge this now? (And I don't mean worrying 
> > about non-existent compliers).
> 
> I propose to take this patch as part of those I will be submitting.
> It took me some unplanned time to add support for hardened user copy,
> but now it's done - at least to a point that I can test it without failures.
> 
> So I'm back on track to provide an example of the smalloc api and I can
> also use Tetsuo's work (thanks again, btw).
> This patch would be sandwiched between the smalloc ones and the LSM rework.
> 
> It can get merged when the rest (hopefully) is merged.
> 
> But I have a more prosaic question: since smalloc is affecting the
> memory subsystem, can it still be merged through the security tree?

It needs acks from the maintainers of the affected subsystems.

-- 
James Morris
<jmorris@namei.org>

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.kernel

csiph-web