linux-kernel - Re: [PATCH] bpf: lsm: Disable or enable BPF LSM at boot time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACYkzJ78HOP8SZ3jU0DnH0b4f8580AuP4fdG5K3xgaHa8VYaZw@mail.gmail.com>
Date:   Mon, 6 Jul 2020 20:59:13 +0200
From:   KP Singh <kpsingh@...omium.org>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     Lorenzo Fontana <fontanalorenz@...il.com>,
        open list <linux-kernel@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>,
        Linux Security Module list 
        <linux-security-module@...r.kernel.org>,
        Jonathan Corbet <corbet@....net>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>,
        John Fastabend <john.fastabend@...il.com>
Subject: Re: [PATCH] bpf: lsm: Disable or enable BPF LSM at boot time

On Mon, Jul 6, 2020 at 8:51 PM Daniel Borkmann <daniel@...earbox.net> wrote:
>
> On 7/6/20 6:57 PM, Lorenzo Fontana wrote:
> > This option adds a kernel parameter 'bpf_lsm',
> > which allows the BPF LSM to be disabled at boot.
> > The purpose of this option is to allow a single kernel
> > image to be distributed with the BPF LSM built in,
> > but not necessarily enabled.
> >
> > Signed-off-by: Lorenzo Fontana <fontanalorenz@...il.com>
>
> Well, this explains what the patch is doing but not *why* you need it exactly.
> Please explain your concrete use-case for this patch.

Also, this patch is not really needed as it can already be done with the current
kernel parameters.

LSMs can be enabled on the command line
with the lsm= parameter. So you can just pass lsm="selinux,capabilities" etc
and not pass "bpf" and it will disable the BPF_LSM.

- KP

>
> Thanks,
> Daniel