netdev - Re: [PATCH 0/4] Fix the NetLabel LSM category mappings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 31 Jul 2014 15:47:29 -0700
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Paul Moore <pmoore@...hat.com>, netdev@...r.kernel.org,
	linux-security-module@...r.kernel.org, selinux@...ho.nsa.gov
CC:	Christian Evans <frodox@...o.com>,
	Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH 0/4] Fix the NetLabel LSM category mappings

On 7/31/2014 2:44 PM, Paul Moore wrote:
> As you will see in the patch descriptions below, the NetLabel LSM
> category mappings are very badly broken.  This patchset should repair
> things and make life better in the future.  The first three patches
> are straight-up bug fixes; the fourth patch doesn't actually fix any
> faulty logic in the code, but rather shortens some stupidly long
> function and structure names relating to the NetLabel category
> mappings.  I should probably do something similar with a lot of other
> NetLabel APIs, but that is for another time.
>
> Thanks to Christian Evans for pointing out one of the original
> problems.  I don't think he realized how many problems there really
> were, but I still owe him one for getting me to revisit this ugly,
> nasty code.  I apologize it took so long to get a fix out and that
> things were broken this badly in the first place.
>
> Casey, I'm CC'ing you here because this patchset does touch some of
> the Smack code, but as you can see the changes are trivial.  I will
> be very surprised if you find anything objectionable in there.
> However, if you do, let me know and I'll fix it.

The code passes my tests. I'll mark the patches "Tested-by:".

> DaveM/netdev folks, you guys are included here for the obvious reason
> that a good chunk of the code changes live in net/*.  However, the
> net/* related changes are all within the NetLabel code and not in the
> core networking stack so I doubt this is something you'll care too
> much about.  I'm going to guess that as far as you're concerned, this
> is just another bugfix to a subsystem you don't really care about.
>
> DaveM, unless you have any objections, I'm planning on pushing this
> via the SELinux tree up through James' LSM tree since that seems to
> make the most sense to me.  If you would rather push it via the netdev
> tree please let me know.
>
> -Paul
>
> ---
>
> Paul Moore (4):
>       netlabel: fix a problem when setting bits below the previously lowest bit
>       netlabel: fix the horribly broken catmap functions
>       netlabel: fix the catmap walking functions
>       netlabel: shorter names for the NetLabel catmap funcs/structs
>
>
>  include/net/netlabel.h        |   94 +++++++-----
>  net/ipv4/cipso_ipv4.c         |   47 ++----
>  net/netlabel/netlabel_kapi.c  |  327 ++++++++++++++++++++++++++++-------------
>  security/selinux/ss/ebitmap.c |  133 +++++++----------
>  security/selinux/ss/ebitmap.h |    8 +
>  security/smack/smack_access.c |   11 +
>  security/smack/smack_lsm.c    |    6 -
>  security/smack/smackfs.c      |   14 +-
>  8 files changed, 366 insertions(+), 274 deletions(-)
>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html