linux-kernel - Re: [RFC v2 2/3] LSM: Add statistics about the invocation of dynamic hooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 11 Dec 2017 09:21:28 +1100 (AEDT)
From:   James Morris <james.l.morris@...cle.com>
To:     Sargun Dhillon <sargun@...gun.me>
cc:     linux-security-module@...r.kernel.org, keescook@...omium.org,
        igor.stoppa@...wei.com, casey@...aufler-ca.com,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC v2 2/3] LSM: Add statistics about the invocation of dynamic
 hooks

On Fri, 8 Dec 2017, Sargun Dhillon wrote:

> The purpose of this is similar to the purpose of something like
> iptables -L -n. With the proliferation of LSMs, it's going to
> be more important to have a way to understand what's going on.

The difference with iptables being that it's an application on top of the 
netfilter hooks, with strongly defined behavioral semantics for matches 
and targets, while their configuration is the security policy.

LSM is more like the raw netfilter layer, and I don't think you can make a 
lot of sense from a list of just which hooks are active.  You need 
semantic knowledge of how those hooks are configured, i.e. security 
policy.

I suggest dropping this part for now at least, and perhaps think about 
building an API on top of this feature with strongly defined semantics 
(e.g. something like iptables on top of netfilter). 

- James
-- 
James Morris
<james.l.morris@...cle.com>