linux-kernel - Re: [PATCH 3/6] secmark: export binary yes/no rather than kernel internal secid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 27 Sep 2010 10:50:34 +1000 (EST)
From:	James Morris <jmorris@...ei.org>
To:	Eric Paris <eparis@...hat.com>
cc:	linux-kernel@...r.kernel.org, selinux@...ho.nsa.gov,
	netfilter-devel@...r.kernel.org, sds@...ho.nsa.gov,
	jengelh@...ozas.de, paul.moore@...com, casey@...aufler-ca.com,
	linux-security-module@...r.kernel.org, netfilter@...r.kernel.org,
	mr.dash.four@...glemail.com
Subject: Re: [PATCH 3/6] secmark: export binary yes/no rather than kernel
 internal secid

On Fri, 24 Sep 2010, Eric Paris wrote:

> Currently the nfconntrack export code sends the kernel internal secid to
> userspace in a couple of proc files and over netlink as an integer.  This
> is wrong.  This number is a kernel internal.

I wouldn't say wrong, exactly.

The secid is a 32-bit integer which each LSM maps to its own domain.  
It's unlikely to change from this format (we were v. lucky to get this 
field, btw).

There's really no difference between this and the various kernel addresses 
exported via procfs by the networking code -- it's an opaque token which 
you can use to identify the security marking of a packet without 
necessarily having any knowledge of the security model itself.

It's potentially useful for debugging and writing simple userland tools, 
and may be in use already by apps.

>  This patch changes the export
> code to output either 0 or 1 for this value.

This potentially breaks existing apps and does not seem to add any value 
itself.  If you want to determine if a packet is marked, then simply check 
for zero or not.

>  A future patch will implement sending the name rather than the number 
> in a new field.

For the reasons above, I think the secctx string needs to be exported in 
addition to this rather than instead of.

- James
-- 
James Morris
<jmorris@...ei.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/