linux-kernel - Re: what happened to SECURITY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAGXu5j+9e9GX1qoAw9S0r2yU-1kpqpMF7qKGyNXpBo3AVck5Ag@mail.gmail.com>
Date:   Thu, 21 Mar 2019 09:36:09 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Randy Dunlap <rdunlap@...radead.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        linux-security-module <linux-security-module@...r.kernel.org>
Subject: Re: what happened to SECURITY_DAC?

On Wed, Mar 20, 2019 at 5:39 PM Randy Dunlap <rdunlap@...radead.org> wrote:
>
> wow.  Commit 70b62c25665f636c9f6c700b26af7df296b0887e
> from last Sept. 14, 2018, total commit description says:
>
>     LoadPin: Initialize as ordered LSM
>
>     This converts LoadPin from being a direct "minor" LSM into an ordered LSM.
>
> Nowhere does it say anything like "this also deletes any notions of
> DEFAULT_SECURITY and DAC."

This was a mistaken merge of chunks from a larger series that Casey
and I were working on. It should have been split out.

> Was this deletion a (sekrit) security issue that was not being highlighted on purpose?

No, just an error while refactoring to in creating CONFIG_LSM.

> and what do you recommend for simple DAC-like security?

See CONFIG_LSM. There are some related issues getting discussed here, too:
https://lore.kernel.org/linux-security-module/f23d0fad-dc72-0e53-cac6-31abfd12a050@I-love.SAKURA.ne.jp/


-- 
Kees Cook