linux-kernel - Re: [PATCH] Add in_execve flag into task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090106155829.GA9773@us.ibm.com>
Date:	Tue, 6 Jan 2009 09:58:29 -0600
From:	"Serge E. Hallyn" <serue@...ibm.com>
To:	Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc:	linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Add in_execve flag into task_struct.

Quoting Tetsuo Handa (penguin-kernel@...ove.sakura.ne.jp):
> Serge,
> 
> James is now reviewing TOMOYO Linux patch and he is caring about
> your comment below.
> 
> Serge E. Hallyn wrote:
> > I don't like the 'in_exec' bit in the task_struct, but adding LSM hooks
> > to let just TOMOYO mark whether you're in exec seems even uglier.
> 
> Let me (once again) ask your comment on 'in_exec' approach
> originally suggested by David Howells ( http://lkml.org/lkml/2008/10/2/127 ).

I still don't like it.  Now I gather the reason for this is that you
want to allow a less trusted domain to execute a file (in a new domain)
without giving it the right to read it?  I'd be interested in hearing
whether others think that's a worthy goal.

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/