linux-kernel - Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201705312031.JFG24680.HQFtMJOLOOFSFV@I-love.SAKURA.ne.jp>
Date:   Wed, 31 May 2017 20:31:01 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     jmorris@...ei.org
Cc:     gnomes@...rguk.ukuu.org.uk, keescook@...omium.org,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com,
        casey@...aufler-ca.com, hch@...radead.org, igor.stoppa@...wei.com,
        james.l.morris@...cle.com, paul@...l-moore.com, sds@...ho.nsa.gov
Subject: Re: [PATCH] LSM: Convert security_hook_heads into explicit array of struct list_head

James Morris wrote:
> On Wed, 31 May 2017, Tetsuo Handa wrote:
> 
> > via lack of ability to use LKM-based LSM modules). My customers cannot afford
> > enabling SELinux, but my customers cannot rebuild their kernels because
> > rebuilding makes it even more difficult to get help from support centers.
> > Therefore, my customers remain unable to use LSM modules which they want.
> > This is really unfortunate for me.
> 
> And they'll be able to get vendor support when they have their own custom 
> LSMs installed?  

As long as customers are using the vmlinux provided by that distributor, they
can get distributor's support regarding problems which are not caused by use of
their own custom LKM-based LSMs. For example, distributors do not unconditionally
reject due to use of storage driver kernel module provided by hardware venders
(or, their servers won't boot) and/or on-access scanner kernel module provided by
antivirus venders. Customers won't be able to get distributor's support regarding
problems caused by use of storage driver / on-access scanner kernel modules not
provided by distributors. But rebuilding the vmlinux in order to use LSM modules
not enabled by distributors makes customer's situation very worse.