netdev - Re: [PATCH 1/2] netlink: add NLA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1537275441.2957.26.camel@sipsolutions.net>
Date:   Tue, 18 Sep 2018 14:57:21 +0200
From:   Johannes Berg <johannes@...solutions.net>
To:     Jamal Hadi Salim <jhs@...atatu.com>,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        Michal Kubecek <mkubecek@...e.cz>
Cc:     linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        jbenc@...hat.com
Subject: Re: [PATCH 1/2] netlink: add NLA_REJECT policy type

On Tue, 2018-09-18 at 08:55 -0400, Jamal Hadi Salim wrote:

> Execute permission kind of thing? i.e if i understood you correctly
> if acl is "rwx" then attribute can only be written to (or read from) if
> the "thing executing" is complete

But it's not an attribute that you're executing, it's some kind of
command, and then you get the return value of that command in that
attribute?

Say you want to scan for wifi networks - you trigger a scan, later you
get a notification giving you some data about the scan (let's say the
time it took) - there's no way you can set that time attribute.

(NB: it doesn't work this way, we don't have that attribute now, but I
didn't want to pick a more complicated example)

> > What would the practical difference be though? Hopefully you wouldn't
> > have write-only attributes, and then NLA_REJECT is basically equivalent?
> > 
> 
> If ACL says "-w-" then reading should get explicit permission denied
> code possibly with an extack which is more descriptive that reading
> is not allowed.

Perhaps. But NLA_REJECT comes with an extack string to tell you, so ...

I dunno. I think we already bloated the policies too much by including
the validation_data pointer, and would hate to add more to that :-)

johannes