linux-kernel - Re: [PATCH v12 0/9] LSM: Multiple concurrent LSMs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50EC5BCD.9000908@tycho.nsa.gov>
Date:	Tue, 08 Jan 2013 12:47:57 -0500
From:	Stephen Smalley <sds@...ho.nsa.gov>
To:	Casey Schaufler <casey@...aufler-ca.com>
CC:	James Morris <jmorris@...ei.org>,
	LSM <linux-security-module@...r.kernel.org>,
	LKLM <linux-kernel@...r.kernel.org>,
	SE Linux <selinux@...ho.nsa.gov>,
	John Johansen <john.johansen@...onical.com>,
	Eric Paris <eparis@...hat.com>,
	Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
	Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH v12 0/9] LSM: Multiple concurrent LSMs

On 01/07/2013 08:54 PM, Casey Schaufler wrote:
> Subject: [PATCH v12 0/9] LSM: Multiple concurrent LSMs
>
> Change the infrastructure for Linux Security Modules (LSM)s
> from a single vector of hook handlers to a list based method
> for handling multiple concurrent modules.
>
> A level of indirection has been introduced in the handling of
> security blobs. LSMs no longer access ->security fields directly,
> instead they use an abstraction provided by lsm_[gs]et field
> functions.
>
> The XFRM hooks are only used by SELinux and it is not clear
> that they can be shared. The First LSM that registers using
> those hooks gets to use them. Any subsequent LSM that uses
> those hooks is denied registration.
>
> Secids have not been made shareable. Only one LSM that uses
> secids (SELinux and Smack) can be used at a time. The first
> to register wins.
>
> The "security=" boot option takes a comma separated list of
> LSMs, registering them in the order presented. The LSM hooks
> will be executed in the order registered. Hooks that return
> errors are not short circuited. All hooks are called even
> if one of the LSM hooks fails. The result returned will be
> that of the last LSM hook that failed.
>
> Some hooks don't fit that model. setprocattr, getprocattr,
> and a few others are special cased. All behavior from
> security/capability.c has been moved into the hook handling.
> The security/commoncap functions used to get called from
> the LSM specific code. The handling of the capability
> functions has been moved out of the LSMs and into the
> hook handling.
>
> The /proc/*/attr interfaces are given to one LSM. This
> can be done by setting CONFIG_SECURITY_PRESENT. Additional
> interfaces have been created in /proc/*/attr so that
> each LSM has its own named interfaces.
>
> Signed-off-by: Casey Schaufler <casey@...aufler-ca.com>

Have you run any benchmarks, particularly to compare performance 
overhead in the simple case of a single LSM?

IIRC, the AppArmor devs indicated that they plan to start using secids, 
which would mean that it would not be possible to stack AppArmor with 
Smack or SELinux using this mechanism.  So eventually that would have to 
be addressed in order for this to even support the AppArmor+Smack or 
AppArmor+SELinux use cases.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/