linux-kernel - Re: [PATCH -v5 -mm] LSM: Add security= boot parameter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 6 Mar 2008 09:56:35 +1100 (EST)
From:	James Morris <jmorris@...ei.org>
To:	Andrew Morton <akpm@...ux-foundation.org>
cc:	"Ahmed S. Darwish" <darwish.07@...il.com>, sds@...ho.nsa.gov,
	casey@...aufler-ca.com, bunk@...nel.org, chrisw@...s-sol.org,
	eparis@...isplace.org, adobriyan@...ru,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH -v5 -mm] LSM: Add security= boot parameter

On Wed, 5 Mar 2008, Andrew Morton wrote:

> > +/* Maximum number of letters for an LSM name string */
> > +#define SECURITY_NAME_MAX	10
> 
> Is this long enough?

I almost flagged this earlier, but I don't think we've ever seen an LSM 
with a longer name, and it can be expanded if needed.  32 or something 
seems similarly arbitrary.

> Please remove this and use compile-time initialisation with DEFINE_SPINLOCK.
> 
> Do we actually need the lock?  This code is only called at boot-time if I
> understand it correctly?

Theoretically, security_module_enable() could be called at any time, 
although it does seem unlikely never to be called at boot, especially if 
multiple LSMs are compiled in.

In that case, perhaps mark the function as __init, and require it be 
called only at boot time.

> Can chosen_lsm[] be __initdata?

With the above, yes.

> > +int security_module_enable(struct security_operations *ops)
> > +}
> 
> I believe this can be __init.

Indeed :-)


- James
-- 
James Morris
<jmorris@...ei.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/