linux-kernel - Re: [RFC v2 1/3] security: Add safe, dynamic (runtime-loadable) hook support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMp4zn89NoTKy9=Ek1FEsv22bGhZb0qCUwT11_+unY2LskBDPQ@mail.gmail.com>
Date:   Wed, 13 Dec 2017 13:38:37 +0100
From:   Sargun Dhillon <sargun@...gun.me>
To:     James Morris <james.l.morris@...cle.com>
Cc:     LSM <linux-security-module@...r.kernel.org>,
        Kees Cook <keescook@...omium.org>,
        Igor Stoppa <igor.stoppa@...wei.com>,
        Casey Schaufler <casey@...aufler-ca.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [RFC v2 1/3] security: Add safe, dynamic (runtime-loadable) hook support

On Sun, Dec 10, 2017 at 11:28 PM, James Morris
<james.l.morris@...cle.com> wrote:
> On Fri, 8 Dec 2017, Sargun Dhillon wrote:
>
>> The primary purpose of this patchset is to facilitate the development of
>> out-of-tree minor LSMs.
>
> This is not a valid use-case for the mainline kernel: we don't add
> features for out of tree code.
>
> Please reconsider your rationale :-)
>
>
> - James
> --
> James Morris
> <james.l.morris@...cle.com>
>
Even a la livepatch? One of our primary usecases is for a safer
version of livepatch, with simpler consistency guarantees. The model
is to be able to generate a module that targets a specific CVE, and
roll it out via DKMS, or similar to a heterogenous fleet.

The other one is to be able to dynamically compile LSMs a la
systemtap, using a DSL. One of the biggest problems we've seen is that
the capability of LSMs is limited by the policy. Changing the policy
requires in-kernel changes, whereas a compiler in userspace is
significantly easier to modify.