linux-kernel - Re: [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 10 Jun 2023 10:00:57 +0200
From:   Roberto Sassu <roberto.sassu@...weicloud.com>
To:     Paul Moore <paul@...l-moore.com>
Cc:     zohar@...ux.ibm.com, dmitry.kasatkin@...il.com, jmorris@...ei.org,
        serge@...lyn.com, stephen.smalley.work@...il.com,
        eparis@...isplace.org, casey@...aufler-ca.com,
        linux-kernel@...r.kernel.org, linux-integrity@...r.kernel.org,
        linux-security-module@...r.kernel.org, selinux@...r.kernel.org,
        bpf@...r.kernel.org, kpsingh@...nel.org, keescook@...omium.org,
        nicolas.bouchinet@...p-os.org,
        Roberto Sassu <roberto.sassu@...wei.com>
Subject: Re: [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new
 inodes

On 6/9/2023 10:05 PM, Paul Moore wrote:
> On Sat, Jun 3, 2023 at 3:16 PM Roberto Sassu
> <roberto.sassu@...weicloud.com> wrote:
>>
>> From: Roberto Sassu <roberto.sassu@...wei.com>
>>
>> One of the major goals of LSM stacking is to run multiple LSMs side by side
>> without interfering with each other. The ultimate decision will depend on
>> individual LSM decision.
>>
>> Several changes need to be made to the LSM infrastructure to be able to
>> support that. This patch set tackles one of them: gives to each LSM the
>> ability to specify one or multiple xattrs to be set at inode creation
>> time and, at the same time, gives to EVM the ability to access all those
>> xattrs and calculate the HMAC on them ...
> 
> Thanks for sticking with this Roberto, I see a few
> comments/suggestions on this patchset, but overall it is looking
> pretty good; I'm hopeful we will be able to merge the next revision.

Thanks for looking at it.

Just sent v12 with the suggestions. One is addressed with a different 
patch set (Smack transmute fixes).

Roberto