linux-kernel - Re: [RFC][PATCH 2/6] Integrity Service API and dummy provider

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0607251104380.21352@d.namei>
Date:	Tue, 25 Jul 2006 11:08:17 -0400 (EDT)
From:	James Morris <jmorris@...ei.org>
To:	Kylene Jo Hall <kjhall@...ibm.com>
cc:	linux-kernel <linux-kernel@...r.kernel.org>,
	LSM ML <linux-security-module@...r.kernel.org>,
	Dave Safford <safford@...ibm.com>,
	Mimi Zohar <zohar@...ibm.com>, Serge Hallyn <sergeh@...ibm.com>
Subject: Re: [RFC][PATCH 2/6] Integrity Service API and dummy provider

On Mon, 24 Jul 2006, Kylene Jo Hall wrote:

> + * @verify_data:
> + *	Verify the integrity of a dentry.
> + *	@dentry contains the dentry structure to be verified.
> + *	Possible return codes are: INTEGRITY_PASS, INTEGRITY_FAIL,
> + * 		INTEGRITY_NOLABEL
> + *
> + * @verify_metadata:
> + *	Verify the integrity of a dentry's metadata; return the value
> + * 	of the requested xattr_name and the verification result of the
> + *	dentry's metadata.
> + *	@dentry contains the dentry structure of the metadata to be verified.
> + *	@xattr_name, if not null, contains the name of the xattr
> + *		 being requested.
> + *	@xattr_value, if not null, is a pointer for the xattr value.
> + *	@xattr_val_len will be set to the length of the xattr value.
> + *	@xattr_status is the result of the getxattr request for the xattr.
> + *	Possible return codes are: INTEGRITY_PASS, INTEGRITY_FAIL,
> + *		INTEGRITY_NOLABEL, -EOPNOTSUPP, -ENOMEM,

What I would suggest with these API calls is that they always only return 
errno values, and that you pass back the INTEGRITY_ values via a pointer.

This ensures that errno values are cleanly propagated throughout the 
kernel and that 'system' errors are separated from higher level integrity 
service status values.


-- 
James Morris
<jmorris@...ei.org>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/