From: Casey Schaufler <casey@schaufler-ca.com>
To: Paul Moore <paul@paul-moore.com>, Kees Cook <keescook@chromium.org>
Cc: LSM <linux-security-module@vger.kernel.org>,
James Morris <jmorris@namei.org>,
John Johansen <john.johansen@canonical.com>,
Stephen Smalley <sds@tycho.nsa.gov>,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
LKLM <linux-kernel@vger.kernel.org>
Subject: [PATCH v5 0/3] LSM: security module information improvements
Date: Fri, 24 Jun 2016 16:26:17 -0700 [thread overview]
Message-ID: <587c9d63-bd39-5781-a7b6-6add2f63c72e@schaufler-ca.com> (raw)
In-Reply-To: <CAHC9VhR2EziX0iDk+xRa8PyRwrOOcgsE3jzbaQzb1Z3tviRLKg@mail.gmail.com>
Subject: [PATCH v5 0/3] LSM: security module information improvements
Changes from v4:
Use kasprintf instead of kzalloc() ... sprintf in more places.
More in the documentation.
Separate module information in contexts with ",". (not yet visible)
Changes from v3:
Use kasprintf instead of kzalloc() ... sprintf.
Create interfaces that make it possible to deal with process
attributes in the face of multiple "major" security modules.
Patch 1/3 adds /sys/kernel/security/lsm, which provides
a list of the active security modules on the system.
$ cat /sys/kernel/security/lsm
capability,yama,loadpin,smack
Patch 2/3 adds a subdirectory in /proc/.../attr for each
security module that exports process attribute data. This
allows a program in easily differentiate between the "current"
value for Smack and AppArmor.
$ cat /proc/self/attr/smack/current
System
$ cat /proc/self/attr/apparmor/current
unconfined
Patch 3/3 adds an interface that provides module identified
information that otherwise matches the "current" attr.
This allows a system with multiple modules to provide the
complete security "context" in one place. A (future) system
with both Smack and AppArmor might report:
$ cat /proc/self/attr/context
smack='System',apparmor='unconfined'
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
Documentation/security/LSM.txt | 34 ++++++--
fs/proc/base.c | 95 +++++++++++++++++++---
fs/proc/internal.h | 1 +
include/linux/lsm_hooks.h | 12 +--
include/linux/security.h | 15 ++--
security/apparmor/lsm.c | 38 +++++++--
security/commoncap.c | 3 +-
security/inode.c | 26 +++++-
security/loadpin/loadpin.c | 2 +-
security/security.c | 177 ++++++++++++++++++++++++++++++++++++++++-
security/selinux/hooks.c | 22 ++++-
security/smack/smack_lsm.c | 22 ++---
security/tomoyo/tomoyo.c | 2 +-
security/yama/yama_lsm.c | 2 +-
14 files changed, 395 insertions(+), 56 deletions(-)
next prev parent reply other threads:[~2016-06-24 23:26 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-23 21:07 [PATCH v4 0/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-23 21:10 ` [PATCH v4 1/3] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2016-06-24 18:56 ` Paul Moore
2016-06-23 21:11 ` [PATCH v4 2/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-24 19:11 ` Paul Moore
2016-06-24 20:05 ` Casey Schaufler
2016-06-24 20:08 ` Kees Cook
2016-06-24 20:29 ` Paul Moore
2016-06-24 23:26 ` Casey Schaufler [this message]
2016-06-24 23:27 ` [PATCH v5 1/3] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2016-06-29 17:01 ` Paul Moore
2016-07-02 17:21 ` John Johansen
2016-06-24 23:29 ` [PATCH v5 2/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-29 17:03 ` Paul Moore
2016-07-02 17:24 ` John Johansen
2016-06-24 23:29 ` [PATCH v4 3/3] LSM: Add context interface for proc attrs Casey Schaufler
2016-06-24 23:38 ` [PATCH v5 " Casey Schaufler
2016-06-29 17:04 ` [PATCH v4 " Paul Moore
2016-07-02 17:25 ` John Johansen
2016-07-05 15:52 ` [PATCH v5 0/3] LSM: security module information improvements - Acked Casey Schaufler
2016-07-08 10:05 ` James Morris
2016-07-08 15:31 ` Casey Schaufler
2016-07-05 15:52 ` [PATCH v5 1/3] LSM: Add /sys/kernel/security/lsm " Casey Schaufler
2016-07-05 15:52 ` [PATCH v5 2/3] LSM: module hierarchy in /proc/.../attr " Casey Schaufler
2016-07-05 15:52 ` [PATCH v5 3/3] LSM: Add context interface for proc attrs " Casey Schaufler
2016-06-23 21:11 ` [PATCH v4 3/3] LSM: Add context interface for proc attrs Casey Schaufler
2016-06-23 21:49 ` Kees Cook
2016-06-23 22:10 ` Casey Schaufler
2016-06-24 16:38 ` [PATCH v4 4/3] LSM: Improve " Casey Schaufler
2016-06-24 17:48 ` Kees Cook
2016-06-24 19:15 ` [PATCH v4 3/3] LSM: Add " Paul Moore
2016-06-24 19:56 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=587c9d63-bd39-5781-a7b6-6add2f63c72e@schaufler-ca.com \
--to=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.