From: Mimi Zohar <zohar@linux.ibm.com>
To: Paul Moore <paul@paul-moore.com>
Cc: Roberto Sassu <roberto.sassu@huaweicloud.com>,
viro@zeniv.linux.org.uk, brauner@kernel.org,
chuck.lever@oracle.com, jlayton@kernel.org, neilb@suse.de,
kolga@netapp.com, Dai.Ngo@oracle.com, tom@talpey.com,
jmorris@namei.org, serge@hallyn.com, dmitry.kasatkin@gmail.com,
eric.snowberg@oracle.com, dhowells@redhat.com, jarkko@kernel.org,
stephen.smalley.work@gmail.com, eparis@parisplace.org,
casey@schaufler-ca.com, shuah@kernel.org, mic@digikod.net,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-nfs@vger.kernel.org, linux-security-module@vger.kernel.org,
linux-integrity@vger.kernel.org, keyrings@vger.kernel.org,
selinux@vger.kernel.org, linux-kselftest@vger.kernel.org,
Roberto Sassu <roberto.sassu@huawei.com>,
Stefan Berger <stefanb@linux.ibm.com>
Subject: Re: [PATCH v9 12/25] security: Introduce file_post_open hook
Date: Thu, 15 Feb 2024 03:16:17 -0500 [thread overview]
Message-ID: <6ffcd054ff81d64b92b52baf097ed21f8ea4d870.camel@linux.ibm.com> (raw)
In-Reply-To: <CAHC9VhQGiSq2LTm7TBvCwDB_NcMe_JjORLbuHVfC4UpJQi_N4g@mail.gmail.com>
On Wed, 2024-02-14 at 16:21 -0500, Paul Moore wrote:
> On Wed, Feb 14, 2024 at 3:07 PM Mimi Zohar <zohar@linux.ibm.com> wrote:
> > On Tue, 2024-02-13 at 10:33 -0500, Paul Moore wrote:
> > > On Tue, Feb 13, 2024 at 7:59 AM Roberto Sassu
> > > <roberto.sassu@huaweicloud.com> wrote:
> > > > On Mon, 2024-02-12 at 16:16 -0500, Paul Moore wrote:
> > > > > On Mon, Feb 12, 2024 at 4:06 PM Mimi Zohar <zohar@linux.ibm.com>
> > > > > wrote:
> > > > > > Hi Roberto,
> > > > > >
> > > > > >
> > > > > > > diff --git a/security/security.c b/security/security.c
> > > > > > > index d9d2636104db..f3d92bffd02f 100644
> > > > > > > --- a/security/security.c
> > > > > > > +++ b/security/security.c
> > > > > > > @@ -2972,6 +2972,23 @@ int security_file_open(struct file *file)
> > > > > > > return fsnotify_perm(file, MAY_OPEN); <=== Conflict
> > > > > >
> > > > > > Replace with "return fsnotify_open_perm(file);"
> > > > > >
> > > > > > > }
> > > > > > >
> > > > > >
> > > > > > The patch set doesn't apply cleaning to 6.8-rcX without this
> > > > > > change. Unless
> > > > > > there are other issues, I can make the change.
> > > > >
> > > > > I take it this means you want to pull this via the IMA/EVM tree?
> > > >
> > > > Not sure about that, but I have enough changes to do to make a v10.
> >
> > @Roberto: please add my "Reviewed-by" to the remaining patches.
> >
> > > Sorry, I should have been more clear, the point I was trying to
> > > resolve was who was going to take this patchset (eventually). There
> > > are other patches destined for the LSM tree that touch the LSM hooks
> > > in a way which will cause conflicts with this patchset, and if
> > > you/Mimi are going to take this via the IMA/EVM tree - which is fine
> > > with me - I need to take that into account when merging things in the
> > > LSM tree during this cycle. It's not a big deal either way, it would
> > > just be nice to get an answer on that within the next week.
> >
> > Similarly there are other changes for IMA and EVM. If you're willing to
> > create
> > a topic branch for just the v10 patch set that can be merged into your tree
> > and
> > into my tree, I'm fine with your upstreaming v10. (I'll wait to send my pull
> > request after yours.) Roberto will add my Ack's to the integrity, IMA, and
> > EVM
> > related patches. However if you're not willing to create a topic branch,
> > I'll
> > upstream the v10 patch set.
>
> I'm not a big fan of sharing topic branches across different subsystem
> trees, I'd much rather just agree that one tree or another takes the
> patchset and the others plan accordingly.
Just curious why not?
> Based on our previous
> discussions I was under the impression that you wanted me to merge
> this patchset into lsm/dev, but it looks like that is no longer the
> case - which is okay by me.
Paul, I don't recall saying that. Please go ahead and upstream it. Roberto can
add my acks accordingly.
Mimi
> Assuming Roberto gets a v10 out soon, do you expect to merge the v10
> patchset and send it up during the upcoming merge window (for v6.9),
> or are you expecting to wait until after the upcoming merge window
> closes and target v6.10? Once again, either is fine, I'm just trying
> to coordinate this with other patches.
next prev parent reply other threads:[~2024-02-15 8:18 UTC|newest]
Thread overview: 101+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-15 18:17 [PATCH v9 00/25] security: Move IMA and EVM to the LSM infrastructure Roberto Sassu
2024-01-15 18:17 ` [PATCH v9 01/25] ima: Align ima_inode_post_setattr() definition with " Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 1/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 02/25] ima: Align ima_file_mprotect() " Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 2/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 03/25] ima: Align ima_inode_setxattr() " Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 3/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 04/25] ima: Align ima_inode_removexattr() " Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 4/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 05/25] ima: Align ima_post_read_file() " Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 5/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 06/25] evm: Align evm_inode_post_setattr() " Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 6/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 07/25] evm: Align evm_inode_setxattr() " Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 7/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 08/25] evm: Align evm_inode_post_setxattr() " Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 8/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 09/25] security: Align inode_setattr hook definition with EVM Roberto Sassu
2024-02-08 3:18 ` [PATCH v9 9/25] " Paul Moore
2024-01-15 18:17 ` [PATCH v9 10/25] security: Introduce inode_post_setattr hook Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-09 10:17 ` Christian Brauner
2024-01-15 18:17 ` [PATCH v9 11/25] security: Introduce inode_post_removexattr hook Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-09 10:17 ` Christian Brauner
2024-01-15 18:17 ` [PATCH v9 12/25] security: Introduce file_post_open hook Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-09 9:56 ` Christian Brauner
2024-02-09 9:59 ` Christian Brauner
2024-02-09 10:12 ` Christian Brauner
2024-02-09 10:46 ` Roberto Sassu
2024-02-09 11:34 ` Christian Brauner
2024-02-09 12:02 ` Roberto Sassu
2024-02-12 21:00 ` Mimi Zohar
2024-02-12 21:16 ` Paul Moore
2024-02-13 12:58 ` Roberto Sassu
2024-02-13 15:33 ` Paul Moore
2024-02-14 20:07 ` Mimi Zohar
2024-02-14 21:21 ` Paul Moore
2024-02-15 8:16 ` Mimi Zohar [this message]
2024-02-15 15:02 ` Paul Moore
2024-01-15 18:17 ` [PATCH v9 13/25] security: Introduce file_release hook Roberto Sassu
2024-01-15 19:15 ` Al Viro
2024-01-16 8:47 ` Roberto Sassu
2024-01-16 16:51 ` Casey Schaufler
2024-01-16 17:33 ` Al Viro
2024-01-16 18:18 ` Casey Schaufler
2024-02-08 3:18 ` Paul Moore
2024-02-09 10:15 ` Christian Brauner
2024-02-12 17:21 ` Stefan Berger
2024-01-15 18:17 ` [PATCH v9 14/25] security: Introduce path_post_mknod hook Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-09 9:54 ` Christian Brauner
2024-02-12 17:23 ` Stefan Berger
2024-01-15 18:17 ` [PATCH v9 15/25] security: Introduce inode_post_create_tmpfile hook Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-09 9:53 ` Christian Brauner
2024-02-12 17:26 ` Stefan Berger
2024-01-15 18:18 ` [PATCH v9 16/25] security: Introduce inode_post_set_acl hook Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-09 9:51 ` Christian Brauner
2024-01-15 18:18 ` [PATCH v9 17/25] security: Introduce inode_post_remove_acl hook Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-09 9:52 ` Christian Brauner
2024-01-15 18:18 ` [PATCH v9 18/25] security: Introduce key_post_create_or_update hook Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-01-15 18:18 ` [PATCH v9 19/25] integrity: Move integrity_kernel_module_request() to IMA Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-12 17:37 ` Stefan Berger
2024-02-12 17:56 ` Paul Moore
2024-02-12 20:28 ` Stefan Berger
2024-02-13 8:57 ` Roberto Sassu
2024-02-13 16:31 ` Stefan Berger
2024-02-15 9:29 ` Roberto Sassu
2024-01-15 18:18 ` [PATCH v9 20/25] ima: Move to LSM infrastructure Roberto Sassu
2024-01-16 18:57 ` Casey Schaufler
2024-02-08 3:18 ` Paul Moore
2024-02-09 9:50 ` Christian Brauner
2024-02-12 17:45 ` Stefan Berger
2024-01-15 18:18 ` [PATCH v9 21/25] ima: Move IMA-Appraisal " Roberto Sassu
2024-01-16 19:03 ` Casey Schaufler
2024-02-08 3:18 ` Paul Moore
2024-02-09 9:45 ` Christian Brauner
2024-01-15 18:18 ` [PATCH v9 22/25] evm: Move " Roberto Sassu
2024-02-08 3:18 ` Paul Moore
2024-02-09 9:48 ` Christian Brauner
2024-02-12 18:26 ` Stefan Berger
2024-01-15 18:18 ` [PATCH v9 23/25] evm: Make it independent from 'integrity' LSM Roberto Sassu
2024-01-16 19:39 ` Casey Schaufler
2024-02-08 3:18 ` Paul Moore
2024-02-12 19:13 ` Stefan Berger
2024-01-15 18:18 ` [PATCH v9 24/25] ima: " Roberto Sassu
2024-01-16 19:40 ` Casey Schaufler
2024-02-12 19:47 ` Stefan Berger
2024-01-15 18:18 ` [PATCH v9 25/25] integrity: Remove LSM Roberto Sassu
2024-01-16 19:41 ` Casey Schaufler
2024-02-08 3:18 ` Paul Moore
2024-02-12 19:50 ` Stefan Berger
2024-02-08 3:18 ` [PATCH v9 0/25] security: Move IMA and EVM to the LSM infrastructure Paul Moore
2024-02-08 8:05 ` Roberto Sassu
2024-02-08 14:16 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6ffcd054ff81d64b92b52baf097ed21f8ea4d870.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=Dai.Ngo@oracle.com \
--cc=brauner@kernel.org \
--cc=casey@schaufler-ca.com \
--cc=chuck.lever@oracle.com \
--cc=dhowells@redhat.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=eparis@parisplace.org \
--cc=eric.snowberg@oracle.com \
--cc=jarkko@kernel.org \
--cc=jlayton@kernel.org \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=kolga@netapp.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=neilb@suse.de \
--cc=paul@paul-moore.com \
--cc=roberto.sassu@huawei.com \
--cc=roberto.sassu@huaweicloud.com \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=shuah@kernel.org \
--cc=stefanb@linux.ibm.com \
--cc=stephen.smalley.work@gmail.com \
--cc=tom@talpey.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).