Re: [PATCH v1] security: Add a new hook: inode_touch_atime

From: "Mickaël Salaün" <mic@digikod.net>
To: Casey Schaufler <casey@schaufler-ca.com>, linux-kernel@vger.kernel.org
Cc: Alexander Viro <viro@zeniv.linux.org.uk>,
	Andreas Gruenbacher <agruenba@redhat.com>,
	Andy Lutomirski <luto@amacapital.net>,
	Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
	Eric Paris <eparis@parisplace.org>,
	James Morris <james.l.morris@oracle.com>,
	John Johansen <john.johansen@canonical.com>,
	Kees Cook <keescook@chromium.org>,
	Kentaro Takeda <takedakn@nttdata.co.jp>,
	Mimi Zohar <zohar@linux.vnet.ibm.com>,
	Paul Moore <paul@paul-moore.com>,
	"Serge E . Hallyn" <serge@hallyn.com>,
	Stephen Smalley <sds@tycho.nsa.gov>,
	Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
	Vivek Goyal <vgoyal@redhat.com>,
	linux-fsdevel@vger.kernel.org,
	linux-security-module@vger.kernel.org
Subject: Re: [PATCH v1] security: Add a new hook: inode_touch_atime
Date: Thu, 22 Dec 2016 01:01:39 +0100	[thread overview]
Message-ID: <585B17E3.5040809@digikod.net> (raw)
In-Reply-To: <f47921a9-bd93-34e4-bbc5-c9129d0c4426@schaufler-ca.com>

[-- Attachment #1.1: Type: text/plain, Size: 808 bytes --]

On 22/12/2016 00:33, Casey Schaufler wrote:
> On 12/21/2016 3:15 PM, Mickaël Salaün wrote:
>> Add a new LSM hook named inode_touch_atime which is needed to deny
>> indirect update of extended file attributes (i.e. access time) which are
>> not catched by the inode_setattr hook. By creating a new hook instead of
>> calling inode_setattr, we avoid to simulate a useless struct iattr.
>>
>> This hook allows to create read-only environments as with read-only
>> mount points. It can also take care of anonymous inodes.
> 
> What security module would use this?

SELinux should be interested. This is useful to create sandboxes so
other LSM may be interested too

I'm working on a new LSM and I would like this kind of hook to create a
real read-only environment.

Regards,
 Mickaël

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]