linux-kernel - Re: [PATCH v6 0/3] security: Yama LSM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5j+KxkASVzo5-i_47gjpAmK1Qp=yjRmLbGrotK4da7iMOQ@mail.gmail.com>
Date:	Tue, 1 Nov 2011 16:23:24 -0700
From:	Kees Cook <keescook@...omium.org>
To:	James Morris <jmorris@...ei.org>
Cc:	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH v6 0/3] security: Yama LSM

On Tue, Nov 1, 2011 at 2:37 PM, James Morris <jmorris@...ei.org> wrote:
> On Tue, 1 Nov 2011, Kees Cook wrote:
>
>> > We probably need to flesh out criteria for inclusion in Yama and document
>> > it.
>>
>> What's the best way for me to help with that documentation?
>
> Perhaps post a basic document for review.  It doesn't have to be a novel.

I've sent this now. We can expand it further if needed.

> One thing I'd like to see is making it clear that if a feature is nacked
> by a core maintainer, Yama is not a means to bypass that nack.  That
> maintainer will need to ack it as part of Yama, too.

At the same time, Yama isn't intended to be an endless dumping ground
for all random things. It's intended to be a place to put DAC
extensions that make sense for general system hardening. I can clarify
that further in the Yama documentation, if that's not already clear.

-Kees

-- 
Kees Cook
ChromeOS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/