linux-kernel - Re: [PATCH v1 3/7] ima: load policy using path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 21 Dec 2015 13:58:59 -0800
From:	"Luis R. Rodriguez" <mcgrof@...not-panic.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	linux-security-module <linux-security-module@...r.kernel.org>,
	Dmitry Kasatkin <d.kasatkin@...sung.com>,
	linux-ima-devel@...ts.sourceforge.net,
	Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
	David Woodhouse <dwmw2@...radead.org>,
	David Howells <dhowells@...hat.com>,
	Vivek Goyal <vgoyal@...hat.com>, Roberts@...e.de,
	William C <william.c.roberts@...el.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Kees Cook <keescook@...omium.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Dmitry Torokhov <dmitry.torokhov@...il.com>,
	Arend Van Spriel <arend@...adcom.com>,
	Tom Gundersen <teg@...m.no>,
	Johannes Berg <johannes@...solutions.net>,
	Seth Forshee <seth.forshee@...onical.com>,
	Julia Lawall <julia.lawall@...6.fr>,
	Kyle McMartin <kyle@...nel.org>,
	Andy Lutomirski <luto@...capital.net>,
	Daniel Vetter <daniel.vetter@...el.com>,
	Ming Lei <ming.lei@...onical.com>,
	Marcel Holtmann <marcel@...tmann.org>,
	Hannes Reinecke <hare@...e.de>, Takashi Iwai <tiwai@...e.de>,
	Rik van Riel <riel@...hat.com>,
	linux-wireless <linux-wireless@...r.kernel.org>,
	"Luis R. Rodriguez" <mcgrof@...not-panic.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v1 3/7] ima: load policy using path

On Thu, Dec 17, 2015 at 11:33 AM, Luis R. Rodriguez <mcgrof@...e.com> wrote:
> Please no, instead of adding yet-another kernel file-loading facility which is
> likely error prone we should consolidate *all kernel file-loading facilities*
> into a *common generic shared one*. So please work to make that happen since you
> need yet-another user for it.m.com
>
> Since you need yet-naother kernel file-loader please do the work to generalize
> it, or at least try it.

As per review in another thread with Mimi we determined they're not
adding a *new* reader, but using an existing one. The possible issues
with early read and pivot_root() as well as possible considerations
for a common user mode helper are still relevant for when we
generalize a common kernel loader. Mimi has also pointed out a few
other kernel loaders. It seems we'll try to tackle this after the
holidays. To help keep track of progress and consolidate notes on this
I've stuffed details about this on this wiki:

http://kernelnewbies.org/KernelProjects/common-kernel-loader

  Luis
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/