lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <1262537872.10218.27.camel@bigi> Date: Sun, 03 Jan 2010 11:57:52 -0500 From: jamal <hadi@...erus.ca> To: Samir Bellabes <sam@...ack.fr> Cc: linux-security-module@...r.kernel.org, Patrick McHardy <kaber@...sh.net>, Evgeniy Polyakov <zbr@...emap.net>, Neil Horman <nhorman@...driver.com>, netdev@...r.kernel.org, netfilter-devel@...r.kernel.org Subject: Re: [RFC 0/9] snet: Security for NETwork syscalls Hi Samir, This fills in a gap i always thought was missing from LSM's boolean verdict policies. So good effort. 1)I would love to see the send/recvmsg interface complete (seems missing). 2) If you can provide an async scheme which allows re-injection of policy verdicts in addition to the sync interface, i think that would be more valuable. I can see many apps which collect multiple states before making a policy decision on multiple messages (example a multipart message). Is SNET_VERDICT_PENDING intended for this? A small glitch i noticed; you have defines in patches 8 and 9 which are needed by patches 6 and 7. I think the general idea should be to compile after adding each patch. So you may need to move some defines in earlier patches. cheers, jamal -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists