netdev - Re: speaking of stacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 4 Apr 2008 08:32:33 -0400
From:	Paul Moore <paul.moore@...com>
To:	hadi@...erus.ca
Cc:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
	joern@...ybastard.org, herbert@...dor.apana.org.au,
	James Morris <jmorris@...ei.org>
Subject: Re: speaking of stacks

On Friday 04 April 2008 8:24:12 am jamal wrote:
> On Thu, 2008-03-04 at 14:18 -0700, David Miller wrote:
> > This whole song and dance here is for SELINUX to set only
> > the policy->security, so that we can pass that back down
> > into the subsequent xfrm_policy_bysel_ctx().
> >
> > The thing to do is to rearrange these security layer hooks
> > so that they take a "struct xfrm_sec_ctx **" instead of
> > a full policy pointer.
> >
> > Then the code would look like:
> >
> > 		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
> > 		struct xfrm_sec_ctx *ctx;
> >
> > 		err = verify_sec_ctx_len(attrs);
> > 		if (err)
> > 			return err;
> >
> > 		if (rt) {
> > 			struct xfrm_user_sec_ctx *uctx = nla_data(rt);
> >
> > 			if ((err = security_xfrm_policy_alloc(&ctx, uctx)))
> > 				return err;
> > 		}
> > 		xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, ctx,
> > 					   delete, &err);
> > 		security_xfrm_policy_free(ctx);
> >
> > And thus the xfrm_policy wouldn't need to be on the stack
> > any longer.
>
> Yes, that would be cleaner than what i did; i will give the
> opportunity to the SELinux folks to take a first crack at it with the
> above approach.
>
> CCing some of the SElinux folks.
> Thanks Dave.

Sorry, I've been stuck under a rock for about the past month. Unless 
somebody is really anxious to do this I'll see if I can whip up an RFC 
patch and get it out either today or early next week.

-- 
paul moore
linux @ hp
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html