linux-kernel - Re: [PATCH 3/3] sysfs: Add labeling support for sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1252584850.13634.876.camel@moss-pluto.epoch.ncsc.mil>
Date:	Thu, 10 Sep 2009 08:14:10 -0400
From:	Stephen Smalley <sds@...ho.nsa.gov>
To:	Casey Schaufler <casey@...aufler-ca.com>
Cc:	Greg KH <gregkh@...e.de>, James Morris <jmorris@...ei.org>,
	"David P. Quigley" <dpquigl@...ho.nsa.gov>, ebiederm@...ssion.com,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH 3/3] sysfs: Add labeling support for sysfs

On Wed, 2009-09-09 at 20:48 -0700, Casey Schaufler wrote:
> Greg KH wrote:
> > On Thu, Sep 10, 2009 at 10:40:59AM +1000, James Morris wrote:
> >   
> >> Thanks, all applied to
> >> git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
> >>     
> >
> > Um, wait, what about the sysfs maintainer's review?  :)
> >
> > I also want to see Casey agree with this as well.
> >   
> 
> Without being able to provide a better solution in a reasonable
> time I don't see that I can responsibly raise an objection. Sure,
> I'd rather see a real implementation of xattrs on memory based
> file systems, but I can't put the time in to make it happen and
> I don't see that it would be "fair" for these people to be held
> up by my petty idiosyncrasies on the topic if I'm not willing to
> make the investment and do it myself.
> 
> Maybe the next time I'm out of work ("Nuts! And I finally got
> asking if they wanted to SuperSize it down!") I'll revive my
> efforts to eliminate secids from the kernel entirely.

Casey - we reworked the patch to avoid the use of secids in the
interface between the security module and sysfs and to support
multi-xattr security modules (by leveraging the previously discussed
hooks introduced for labeled NFS).  So I believe we went to the trouble
of addressing your concerns.  An Acked-by would be appreciated (and is
necessary at least for the changes to Smack, which we updated for you to
likewise support sysfs labeling).

-- 
Stephen Smalley
National Security Agency

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/