* what happened to SECURITY_DAC?
@ 2019-03-21 0:39 Randy Dunlap
2019-03-21 16:36 ` Kees Cook
0 siblings, 1 reply; 2+ messages in thread
From: Randy Dunlap @ 2019-03-21 0:39 UTC (permalink / raw)
To: Kees Cook, LKML
wow. Commit 70b62c25665f636c9f6c700b26af7df296b0887e
from last Sept. 14, 2018, total commit description says:
LoadPin: Initialize as ordered LSM
This converts LoadPin from being a direct "minor" LSM into an ordered LSM.
Nowhere does it say anything like "this also deletes any notions of
DEFAULT_SECURITY and DAC."
Was this deletion a (sekrit) security issue that was not being highlighted on purpose?
and what do you recommend for simple DAC-like security?
thanks. :(
--
~Randy
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: what happened to SECURITY_DAC?
2019-03-21 0:39 what happened to SECURITY_DAC? Randy Dunlap
@ 2019-03-21 16:36 ` Kees Cook
0 siblings, 0 replies; 2+ messages in thread
From: Kees Cook @ 2019-03-21 16:36 UTC (permalink / raw)
To: Randy Dunlap; +Cc: LKML, linux-security-module
On Wed, Mar 20, 2019 at 5:39 PM Randy Dunlap <rdunlap@infradead.org> wrote:
>
> wow. Commit 70b62c25665f636c9f6c700b26af7df296b0887e
> from last Sept. 14, 2018, total commit description says:
>
> LoadPin: Initialize as ordered LSM
>
> This converts LoadPin from being a direct "minor" LSM into an ordered LSM.
>
> Nowhere does it say anything like "this also deletes any notions of
> DEFAULT_SECURITY and DAC."
This was a mistaken merge of chunks from a larger series that Casey
and I were working on. It should have been split out.
> Was this deletion a (sekrit) security issue that was not being highlighted on purpose?
No, just an error while refactoring to in creating CONFIG_LSM.
> and what do you recommend for simple DAC-like security?
See CONFIG_LSM. There are some related issues getting discussed here, too:
https://lore.kernel.org/linux-security-module/f23d0fad-dc72-0e53-cac6-31abfd12a050@I-love.SAKURA.ne.jp/
--
Kees Cook
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-03-21 16:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-21 0:39 what happened to SECURITY_DAC? Randy Dunlap
2019-03-21 16:36 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).