linux-kernel - Re: [GIT PULL] LSM patches for v6.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhTmfRhYCJibpZ20ibH-JhVMrwbpFdCtKUz5tqFHsjLRiw@mail.gmail.com>
Date:   Wed, 5 Oct 2022 12:04:27 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL] LSM patches for v6.1

On Wed, Oct 5, 2022 at 11:33 AM Eric W. Biederman <ebiederm@...ssion.com> wrote:
> Paul Moore <paul@...l-moore.com> writes:
> > On Wed, Oct 5, 2022 at 8:39 AM Eric W. Biederman <ebiederm@...ssion.com> wrote:
> >> Linus Torvalds <torvalds@...ux-foundation.org> writes:

...

> >> Effectively he said that where two or more out of tree LSM policies want
> >> something it makes no sense to discussion the actual reasons people want
> >> to use the hook.
> >
> > Runtime kernel configuration is inherently "out of tree", this
> > includes not only loadable LSM security policies (e.g. a SELinux
> > policy), the system's firewall configuration, things like sysctl.conf,
> > and countless others.  Please understand that "out of tree" in this
> > context is not the same as when it is used in the context of kernel
> > code; the former is actually a positive thing ("look we can configure
> > the kernel behavior the way we want!") while the latter is a
> > maintenance and support nightmare.
>
> Paul are you saying my experience with /proc/net pointing incorrectly at
> /proc/self/net instead of /proc/thread-self/net is invalid?

My comment was that runtime kernel configuration is always going to be
out of tree due to its very nature, and conflating runtime
configuration with kernel code is a mistake.

-- 
paul-moore.com