linux-kernel - Re: [PATCH 0/7 v22] LSM: Multiple concurrent LSMs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 07 May 2015 13:36:45 -0700
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Stephen Smalley <sds@...ho.nsa.gov>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	Paul Moore <paul@...l-moore.com>
CC:	James Morris <jmorris@...ei.org>,
	James Morris <james.l.morris@...cle.com>,
	LSM <linux-security-module@...r.kernel.org>,
	LKLM <linux-kernel@...r.kernel.org>,
	Paul Moore <pmoore@...hat.com>,
	John Johansen <john.johansen@...onical.com>,
	Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
	Eric Paris <eparis@...hat.com>,
	Kees Cook <keescook@...omium.org>,
	Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH 0/7 v22] LSM: Multiple concurrent LSMs

On 5/7/2015 1:23 PM, Stephen Smalley wrote:
> On 05/07/2015 04:22 PM, Mimi Zohar wrote:
>> On Thu, 2015-05-07 at 14:07 -0400, Paul Moore wrote:
>>> On Thu, May 7, 2015 at 10:47 AM, Casey Schaufler <casey@...aufler-ca.com> wrote:
>>>> On 5/7/2015 4:37 AM, James Morris wrote:
>>>>> On Sat, 2 May 2015, Casey Schaufler wrote:
>>>>>
>>>>>> Subject: [PATCH 0/7 v22] LSM: Multiple concurrent LSMs
>>>>> Please add all of the Acked-by etc. from the patch review process.
>>>> For v21 I had Acks from:
>>>>
>>>>         John Johansen <john.johansen@...onical.com>
>>>>         Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
>>>>         Stephen Smalley <sds@...ho.nsa.gov> (after patch 8/7)
>>>>         Kees Cook <keescook@...omium.org>
>>>>
>>>> Would you check out v22 and supply (or not) your Acks?
>>>>
>>>> Eric, Paul, it would be reassuring if you'd chime in as well.
>>> Kubernetes has swallowed Eric whole I'm afraid, I don't think you want
>>> to wait on him to review these patches.
>>>
>>> However, it is a bit ridiculous that I haven't had time to seriously
>>> review these patches yet; I promise to take a look and send my
>>> comments/ACKs before my head hits the pillow tonight.
>> Seems to be working with SELinux, EVM and IMA enabled.  I haven't tried
>> enabling an additional LSM.   Casey, do you have an additional LSM for
>> testing?
> I've tested SELinux+Yama.

The deepest "stack" you can have today is Capability+Yama+YourChoice.
You always get Capability, so you really only get to choose if you stack
Yama with something else. That's not more depth than you had before, but
the special case coding for Capability and Yama is replaced to the general
scheme.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/