Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1620674

Re: [PATCH RFC v2 2/3] security: add the ModAutoRestrict Linux Security Module

Show all headers | View raw

On Mon, Apr 10, 2017 at 9:04 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
> On 4/10/2017 11:27 AM, Djalal Harouni wrote:
>> On Mon, Apr 10, 2017 at 5:42 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
>>> On 4/9/2017 3:42 AM, Djalal Harouni wrote:
[...]

>>>> --- a/security/security.c
>>>> +++ b/security/security.c
>>>> @@ -70,6 +70,7 @@ int __init security_init(void)
>>>>       capability_add_hooks();
>>>>       yama_add_hooks();
>>>>       loadpin_add_hooks();
>>>> +     modautorestrict_init();
>>> This should be modautorestrict_add_hooks() if this were
>>> a "minor" module, but as it's using a blob it is a "major"
>>> module. Either way, this is not right.
>> Do you mean that if I'm using a blob, it should go with the rest LSMs
>> in do_security_initcalls() ?
>
> Right. Today you have coincidental non-interference because
> no one else is using the task blob. As you're aware, TOMOYO
> is going to start using it, and I believe the AppArmor has
> plans for it as well. There are parts of the Smack cred blob
> that should probably go in the task blob as they aren't used
> in access decisions. I haven't looked closely enough, but that's
> possible for SELinux, too. So even though it's a new blob, the
> major/minor rules apply.
>

Ok, point taken.

Thanks!

-- 
tixxdz

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [PATCH RFC v2 2/3] security: add the ModAutoRestrict Linux  Security Module Casey Schaufler <casey@schaufler-ca.com> - 2017-04-10 17:50 +0200
  Re: [PATCH RFC v2 2/3] security: add the ModAutoRestrict Linux  Security Module Djalal Harouni <tixxdz@gmail.com> - 2017-04-10 20:30 +0200
    Re: [PATCH RFC v2 2/3] security: add the ModAutoRestrict Linux  Security Module Casey Schaufler <casey@schaufler-ca.com> - 2017-04-10 21:10 +0200
      Re: [PATCH RFC v2 2/3] security: add the ModAutoRestrict Linux  Security Module Djalal Harouni <tixxdz@gmail.com> - 2017-04-10 22:00 +0200

csiph-web