linux-kernel - Re: [PATCH v15 00/11] LSM: Three basic syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <80f05011bf9fe19bde1f923e98c2db69ffc91065.camel@linux.ibm.com>
Date:   Wed, 18 Oct 2023 16:10:55 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Paul Moore <paul@...l-moore.com>,
        Roberto Sassu <roberto.sassu@...weicloud.com>
Cc:     Casey Schaufler <casey@...aufler-ca.com>,
        linux-security-module@...r.kernel.org, jmorris@...ei.org,
        serge@...lyn.com, keescook@...omium.org,
        john.johansen@...onical.com, penguin-kernel@...ove.sakura.ne.jp,
        stephen.smalley.work@...il.com, linux-kernel@...r.kernel.org,
        linux-api@...r.kernel.org, mic@...ikod.net,
        linux-integrity@...r.kernel.org
Subject: Re: [PATCH v15 00/11] LSM: Three basic syscalls

On Wed, 2023-10-18 at 12:35 -0400, Paul Moore wrote:
> On Wed, Oct 18, 2023 at 10:15 AM Roberto Sassu
> <roberto.sassu@...weicloud.com> wrote:
> > On 10/18/2023 3:09 PM, Mimi Zohar wrote:
> 
> ...
> 
> > > I agree with Roberto.  All three should be defined: LSM_ID_INTEGRITY,
> > > LSM_ID_IMA, LSM_ID_EVM.
> >
> > I did not try yet, but the 'integrity' LSM does not need an LSM ID. With
> > the last version adding hooks to 'ima' or 'evm', it should be sufficient
> > to keep DEFINE_LSM(integrity) with the request to store a pointer in the
> > security blob (even the init function can be a dummy function).
> 
> First off, this *really* should have been brought up way, way, *way*
> before now.  This patchset has been discussed for months, and bringing
> up concerns in the eleventh hour is borderline rude.

As everyone knows IMA and EVM are not LSMs at this point.

So the only thing that is "rude" is the way you're responding in this
thread.

> 
> At least we haven't shipped this in a tagged release from Linus yet,
> so there is that.

What does that have to do with anything?!  Code changes.

Mimi