linux-kernel - Re: [RFC][PATCH 2/6] Integrity Service API and dummy provider

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <OF6DA008AE.385E4929-ON852571B6.006D8515-852571B6.006F98E0@us.ibm.com>
Date:	Tue, 25 Jul 2006 16:14:20 -0400
From:	Mimi Zohar <zohar@...ibm.com>
To:	James Morris <jmorris@...ei.org>
Cc:	David Safford <safford@...ibm.com>, kjhall@...ibm.com,
	linux-kernel <linux-kernel@...r.kernel.org>,
	LSM ML <linux-security-module@...r.kernel.org>,
	linux-security-module-owner@...r.kernel.org,
	Serge E Hallyn <sergeh@...ibm.com>
Subject: Re: [RFC][PATCH 2/6] Integrity Service API and dummy provider


On 07/25/2006 11:08:17 AM, James Morris wrote:

> On Mon, 24 Jul 2006, Kylene Jo Hall wrote:
>
> > + * @verify_data:
> > + *   Verify the integrity of a dentry.
> > + *   @dentry contains the dentry structure to be verified.
> > + *   Possible return codes are: INTEGRITY_PASS, INTEGRITY_FAIL,
> > + *       INTEGRITY_NOLABEL
> > + *
> > + * @verify_metadata:
> > + *   Verify the integrity of a dentry's metadata; return the value
> > + *    of the requested xattr_name and the verification result of the
> > + *   dentry's metadata.
> > + *   @dentry contains the dentry structure of the metadata to be
verified.
> > + *   @xattr_name, if not null, contains the name of the xattr
> > + *       being requested.
> > + *   @xattr_value, if not null, is a pointer for the xattr value.
> > + *   @xattr_val_len will be set to the length of the xattr value.
> > + *   @xattr_status is the result of the getxattr request for the
xattr.
> > + *   Possible return codes are: INTEGRITY_PASS, INTEGRITY_FAIL,
> > + *      INTEGRITY_NOLABEL, -EOPNOTSUPP, -ENOMEM,
>
> What I would suggest with these API calls is that they always only return

> errno values, and that you pass back the INTEGRITY_ values via a pointer.
>
> This ensures that errno values are cleanly propagated throughout the
> kernel and that 'system' errors are separated from higher level integrity

> service status values.

Yes, that definitely would be cleaner.  We'll include this change in the
next
set of patches.

Thank you.

Mimi Zohar

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/