linux-kernel - Re: [GIT PULL] security changes for v6.9-rc3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87le5mxwry.fsf@email.froward.int.ebiederm.org>
Date: Tue, 09 Apr 2024 12:37:21 -0500
From: "Eric W. Biederman" <ebiederm@...ssion.com>
To: Paul Moore <paul@...l-moore.com>
Cc: Al Viro <viro@...iv.linux.org.uk>,  Linus Torvalds
 <torvalds@...ux-foundation.org>,  Roberto Sassu
 <roberto.sassu@...weicloud.com>,  linux-integrity@...r.kernel.org,
  linux-security-module@...r.kernel.org,  linux-fsdevel@...r.kernel.org,
  linux-cifs@...r.kernel.org,  linux-kernel@...r.kernel.org,  Roberto Sassu
 <roberto.sassu@...wei.com>
Subject: Re: [GIT PULL] security changes for v6.9-rc3

Paul Moore <paul@...l-moore.com> writes:

> I know it's everyone's favorite hobby to bash the LSM and LSM devs,
> but it's important to note that we don't add hooks without working
> with the associated subsystem devs to get approval.

Hah!!!!

> In the cases
> where we don't get an explicit ACK, there is an on-list approval, or
> several ignored on-list attempts over weeks/months/years.  We want to
> be good neighbors.

Hah!!!!

You merged a LSM hook that is only good for breaking chrome's sandbox,
over my expressed objections.  After I tested and verified that
is what it does.

I asked for testing. None was done.  It was claimed that no
security sensitive code would ever fail to check and deal with
all return codes, so no testing was necessary.  Then later a
whole bunch of security sensitive code that didn't was found.

The only redeeming grace has been that no-one ever actually uses
that misbegotten security hook.

P.S.  Sorry for this off topic rant but sheesh.   At least from
my perspective you deserve plenty of bashing.

Eric