linux-kernel - RE: [RFC 3/4] security/checmate: Add Checmate sample

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2236FBA76BA1254E88B949DDB74E612B41B72014@IRSMSX102.ger.corp.intel.com>
Date:	Fri, 5 Aug 2016 11:10:37 +0000
From:	"Reshetova, Elena" <elena.reshetova@...el.com>
To:	"sargun@...gun.me" <sargun@...gun.me>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:	Alexei Starovoitov <alexei.starovoitov@...il.com>,
	Daniel Borkmann <daniel@...earbox.net>,
	"linux-security-module@...r.kernel.org" 
	<linux-security-module@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [RFC 3/4] security/checmate: Add Checmate sample

Sorry have to resend from normal mail client due to gmail stupid interface. I 
am not able to find plain text button anywhere anymore...

>On Fri, 5 Aug 2016 at 13:49 Elena Reshetova <elena.reshetova@...il.com> 
>wrote:

>The Checmate sample installs a policy barring new AF_INET connections
>to port 1. We install the hook, and show an example of connect
>returning EPERM, and then reset the policy.

Could you actually provide a more complex example, where you actually need to 
share a state between different hooks?
Even minor LSMs need to keep internal info in one way or another to make 
useful decisions. Like Yama needs to track ptrace info, Hardchroot would need 
to track if process is inside chroot or not and etc.

Download attachment "smime.p7s" of type "application/pkcs7-signature" (7586 bytes)