linux-kernel - Re: [PATCH] security: Split out hook definitions into lsm_hook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 31 Mar 2018 22:15:39 -0700
From:   Sargun Dhillon <sargun@...gun.me>
To:     LSM <linux-security-module@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        Kees Cook <keescook@...omium.org>,
        Igor Stoppa <igor.stoppa@...wei.com>,
        Casey Schaufler <casey@...aufler-ca.com>,
        James Morris <jmorris@...ei.org>,
        Stephen Smalley <sds@...ho.nsa.gov>,
        Paul Moore <paul@...l-moore.com>, plautrba@...hat.com
Subject: Re: [PATCH] security: Split out hook definitions into lsm_hook_types.h

On Sat, Mar 31, 2018 at 7:40 PM, Sargun Dhillon <sargun@...gun.me> wrote:
> This moves all of the LSM hooks type information into a separate file,
> lsm_hook_types.h. This enables us to use this file, along with macros
> to generate the security_hook_heads struct, as well as the security
> hooks union without having to duplicate definitions.
>
> Since the fall-back hooks still require some logic (dispatching
> to commoncap, nulling out some buffer, etc..), they still must
> be created manually.
>
> This will be useful for further datastructures which want to use
> the set of security hooks in a completely unrolled way, along
> with the type information there within.
>
> Signed-off-by: Sargun Dhillon <sargun@...gun.me>
> ---
>  include/linux/lsm_hook_types.h | 1695 ++++++++++++++++++++++++++++++++++
>  include/linux/lsm_hooks.h      | 1946 +---------------------------------------
>  include/linux/security.h       |  416 ++-------
>  kernel/time/time.c             |    6 +-
>  security/security.c            |    2 +-
>  5 files changed, 1783 insertions(+), 2282 deletions(-)
>  create mode 100644 include/linux/lsm_hook_types.h
>
>
Upon further thought, this patch is somewhat unwieldy. I intent to
split it up. I plan to split it into the following:
1. Fixing the settimeofday64 weirdness
2. 1:1 move from lsm_hooks.h to lsm_hook_types.h of the hook
definitions (union + comments)
3. Rewiring lsm_hooks.h to use macros only
4. Rewiring security.h to use macros only

Does that sound reasonable?