linux-kernel - Re: [PATCH 3/6] secmark: export binary yes/no rather than kernel internal secid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 28 Sep 2010 02:00:27 +0200 (CEST)
From:	Jan Engelhardt <jengelh@...ozas.de>
To:	Pablo Neira Ayuso <pablo@...filter.org>
cc:	Eric Paris <eparis@...hat.com>, Paul Moore <paul.moore@...com>,
	James Morris <jmorris@...ei.org>, linux-kernel@...r.kernel.org,
	selinux@...ho.nsa.gov, netfilter-devel@...r.kernel.org,
	sds@...ho.nsa.gov, casey@...aufler-ca.com,
	linux-security-module@...r.kernel.org, netfilter@...r.kernel.org,
	mr.dash.four@...glemail.com
Subject: Re: [PATCH 3/6] secmark: export binary yes/no rather than kernel
 internal secid

On Tuesday 2010-09-28 00:48, Pablo Neira Ayuso wrote:

>On 27/09/10 21:25, Eric Paris wrote:
>> I see it as having 3 options.  lets assume was have a packet with
>> selinux sid=121 and selinux context=packet_t.  We can
>> 
>> 1) secmark=121 secctx=packet_t
>> 	This continues to send secmark like we do and people might continue to
>> be baffled by the 121.
>> 
>> 2) secmark=1 secctx=packet_t
>> 	This sends a secmark field to userspace so if an application which
>> reads this exists (I doubt such an application actually exists in in the
>> real world) it will still get all of the information it got before but
>> noone will be baffled by what the number means.  1/0 is pretty obvious.
>
>In netlink, we can obsolete fields without breaking backward
>compatibility. Applications parsing the /proc entry may break, but they
>should use stable interfaces (like netlink) instead.

Which I take as a pro stance on not adding any more procfs fields.

>BTW, if we finally stop including CTA_SECMARK in netlink messages,
>please add a small comment on the right of the definition in
>nfnetlink_conntrack.h (something like /* obsolete */ or /* unused */).
>Thanks!

Mh, I prefer "obsolete". A lot of times in the kernel there is "unused" 
and it reads like, "if it's unused, why is is there?" (it /is/ used, 
though as a filler).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/