lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LRH.2.21.1906250853290.7826@namei.org>
Date:   Tue, 25 Jun 2019 09:01:44 +1000 (AEST)
From:   James Morris <jmorris@...ei.org>
To:     Matthew Garrett <matthewgarrett@...gle.com>
cc:     linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-api@...r.kernel.org,
        Stephen Smalley <sds@...ho.nsa.gov>,
        Andy Lutomirski <luto@...capital.net>,
        John Johansen <john.johansen@...onical.com>,
        Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH V34 00/29] Lockdown as an LSM

On Fri, 21 Jun 2019, Matthew Garrett wrote:

> Minor updates over V33 - security_is_locked_down renamed to
> security_locked_down, return value of security_locked_down is returned
> in most cases, one unnecessary patch was dropped, couple of minor nits
> fixed.

Thanks for the respin.

We are still not resolved on granularity. Stephen has said he's not sure 
if a useful policy can be constructed with just confidentiality and 
integrity settings. I'd be interested to know JJ and Casey's thoughts on 
lockdown policy flexibility wrt their respective LSMs.

These are also "all or nothing" choices which may prevent deployment due 
to a user needing to allow (presumably controlled or mitigated) exceptions 
to the policy.



-- 
James Morris
<jmorris@...ei.org>

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ