From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932279AbdJURSC (ORCPT ); Sat, 21 Oct 2017 13:18:02 -0400 Received: from sonic312-28.consmr.mail.ne1.yahoo.com ([66.163.191.209]:41231 "EHLO sonic312-28.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932149AbdJURR6 (ORCPT ); Sat, 21 Oct 2017 13:17:58 -0400 X-YMail-OSG: vj1GaWoVM1l.t41pr_t5EK2PjSEBjWLrS5PpvGyOgBI_60htmxSp7SMqWyO1W.f de2qDcbE3Q4LAhJopQV7_0lw3FEJDVPQ6O4b5369w9GknnqOikaF7.A30T3Fb3ChqARAchSNALKd MOGgcHn2tuZqZOVtT5lzIWdlLXymnjV5Wit11r1V4TpQ03R39dLtsWkL.yA5lu.v002NfAhwrMof 1tr_v9Xy2MWEYR4rc7O7_fzODcA3UfrXbcqn8eNnazEgJ5flkfvfYVZ18blG6QPY9eFvTcMPwBgt Y1njoIG6uu75EMKuHiOEUMhDHH.3PrNdTnuuE6CsS_Qe_dcVIlJM3ejH.yXUxh3dlCZa1ZInkxBe KoWA7dn93vIeymJttIhEK6OIj4f9atCFfiiIhJh4LOSQ72nnrwp_6CRjcRpg4OwW7rLyR.oXURPg 5L10kTwduAHdiJw9wVcb_UyemLQIg3Z5y9p8ccSXHF6Q9xQi52Ddlm1xqujUJ5h1YzYHJKkXPZM0 NKOxDtEv0neF.xzd0Raw- X-Yahoo-Newman-Id: 65110.68490.bm@smtp114.mail.ne1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: vj1GaWoVM1l.t41pr_t5EK2PjSEBjWLrS5PpvGyOgBI_60h tmxSp7SMqWyO1W.fde2qDcbE3Q4LAhJopQV7_0lw3FEJDVPQ6O4b5369w9Gk nnqOikaF7.A30T3Fb3ChqARAchSNALKdMOGgcHn2tuZqZOVtT5lzIWdlLXym njV5Wit11r1V4TpQ03R39dLtsWkL.yA5lu.v002NfAhwrMof1tr_v9Xy2MWE YR4rc7O7_fzODcA3UfrXbcqn8eNnazEgJ5flkfvfYVZ18blG6QPY9eFvTcMP wBgtY1njoIG6uu75EMKuHiOEUMhDHH.3PrNdTnuuE6CsS_Qe_dcVIlJM3ejH .yXUxh3dlCZa1ZInkxBeKoWA7dn93vIeymJttIhEK6OIj4f9atCFfiiIhJh4 LOSQ72nnrwp_6CRjcRpg4OwW7rLyR.oXURPg5L10kTwduAHdiJw9wVcb_Uye mLQIg3Z5y9p8ccSXHF6Q9xQi52Ddlm1xqujUJ5h1YzYHJKkXPZM0NKOxDtEv 0neF.xzd0Raw- X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- Subject: Re: [PATCH 0/8] CaitSith LSM module To: Tetsuo Handa Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org References: <201611231531.DGH52135.QtFVOFJLOHFOSM@I-love.SAKURA.ne.jp> <2908442d-90f1-7fa2-24ff-0833f6bd2d95@canonical.com> <201705211359.BBE26079.LSJFOMHFOVQFOt@I-love.SAKURA.ne.jp> <8c6da617-3325-d60d-805f-5e5c1fa322c6@canonical.com> <201705211459.EGB48959.OFVFOSHtFJMLQO@I-love.SAKURA.ne.jp> <201710211959.CEC65165.SQJOLOFVOtFFHM@I-love.SAKURA.ne.jp> From: Casey Schaufler Message-ID: <7cab86a5-e115-0905-4d72-8cae7f6540b9@schaufler-ca.com> Date: Sat, 21 Oct 2017 10:17:55 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <201710211959.CEC65165.SQJOLOFVOtFFHM@I-love.SAKURA.ne.jp> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/21/2017 3:59 AM, Tetsuo Handa wrote: > Tetsuo Handa wrote: >> John Johansen wrote: >>> On 05/20/2017 09:59 PM, Tetsuo Handa wrote: >>>> John Johansen wrote: >>>>> On 11/22/2016 10:31 PM, Tetsuo Handa wrote: >>>>>> Tetsuo Handa wrote: >>>>>>> John Johansen wrote: >>>>>>>>> In order to minimize the burden of reviewing, this patchset implements >>>>>>>>> only functionality of checking program execution requests (i.e. execve() >>>>>>>>> system call) using pathnames. I'm planning to add other functionalities >>>>>>>>> after this version got included into mainline. You can find how future >>>>>>>>> versions of CaitSith will look like at http://caitsith.osdn.jp/ . >>>>>>>>> >>>>>>>> Thanks I've started working my way through this, but it is going to take >>>>>>>> me a while. >>>>>>>> >>>>>>> Thank you for your time. >>>>>> May I hear the status? Is there something I can do other than waiting? >>>>>> >>>>> progressing very slowly, I have some time over the next few days as its a >>>>> long weekend here in the US some hopefully I can finish this up >>>>> >>>> May I hear the status again? >>>> >>> Yes, sorry. I just haven't had time too look at it recently. I am sorry that >>> it has been so long. I am just going to have to book a day off and do it. I'll >>> see if I can't get a day next week (getting late but I can try or the following) >> No problem. ;-) I assume reviewing a new module takes at least one year. >> Thank you for remembering. >> > I'm still fighting with OOM killer related problems at MM subsystem. ;-) > > As one year elapsed since I proposed CaitSith for upstream, I'd like to > hear the status again. I looked at > http://schd.ws/hosted_files/lss2017/8b/201709-LinuxSecuritySummit-Stacking.pdf . > How is ETA for Security Module Stacking? Is it a half year or so? Assuming that I can keep working on stacking at my current level, and that we can work out a couple issues with audit and networking there is a possibility we're looking at mid 2018 for stacking. The increased interest in security module namespaces for containers is helping make stacking seem important to more people. > If it is likely take longer, should I resume proposing CaitSith for now > as one of "Minor modules" except security_module_enable() check added > until Security Module Stacking work completes? Or should I wait for > completion of stacking work? I want to know it, for recent proposals are > rather staying silent. I wouldn't wait if it was my project, but I have been known to be more aggressive than is good for me from time to time. > Regards. > From mboxrd@z Thu Jan 1 00:00:00 1970 From: casey@schaufler-ca.com (Casey Schaufler) Date: Sat, 21 Oct 2017 10:17:55 -0700 Subject: [PATCH 0/8] CaitSith LSM module In-Reply-To: <201710211959.CEC65165.SQJOLOFVOtFFHM@I-love.SAKURA.ne.jp> References: <201611231531.DGH52135.QtFVOFJLOHFOSM@I-love.SAKURA.ne.jp> <2908442d-90f1-7fa2-24ff-0833f6bd2d95@canonical.com> <201705211359.BBE26079.LSJFOMHFOVQFOt@I-love.SAKURA.ne.jp> <8c6da617-3325-d60d-805f-5e5c1fa322c6@canonical.com> <201705211459.EGB48959.OFVFOSHtFJMLQO@I-love.SAKURA.ne.jp> <201710211959.CEC65165.SQJOLOFVOtFFHM@I-love.SAKURA.ne.jp> Message-ID: <7cab86a5-e115-0905-4d72-8cae7f6540b9@schaufler-ca.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On 10/21/2017 3:59 AM, Tetsuo Handa wrote: > Tetsuo Handa wrote: >> John Johansen wrote: >>> On 05/20/2017 09:59 PM, Tetsuo Handa wrote: >>>> John Johansen wrote: >>>>> On 11/22/2016 10:31 PM, Tetsuo Handa wrote: >>>>>> Tetsuo Handa wrote: >>>>>>> John Johansen wrote: >>>>>>>>> In order to minimize the burden of reviewing, this patchset implements >>>>>>>>> only functionality of checking program execution requests (i.e. execve() >>>>>>>>> system call) using pathnames. I'm planning to add other functionalities >>>>>>>>> after this version got included into mainline. You can find how future >>>>>>>>> versions of CaitSith will look like at http://caitsith.osdn.jp/ . >>>>>>>>> >>>>>>>> Thanks I've started working my way through this, but it is going to take >>>>>>>> me a while. >>>>>>>> >>>>>>> Thank you for your time. >>>>>> May I hear the status? Is there something I can do other than waiting? >>>>>> >>>>> progressing very slowly, I have some time over the next few days as its a >>>>> long weekend here in the US some hopefully I can finish this up >>>>> >>>> May I hear the status again? >>>> >>> Yes, sorry. I just haven't had time too look at it recently. I am sorry that >>> it has been so long. I am just going to have to book a day off and do it. I'll >>> see if I can't get a day next week (getting late but I can try or the following) >> No problem. ;-) I assume reviewing a new module takes at least one year. >> Thank you for remembering. >> > I'm still fighting with OOM killer related problems at MM subsystem. ;-) > > As one year elapsed since I proposed CaitSith for upstream, I'd like to > hear the status again. I looked at > http://schd.ws/hosted_files/lss2017/8b/201709-LinuxSecuritySummit-Stacking.pdf . > How is ETA for Security Module Stacking? Is it a half year or so? Assuming that I can keep working on stacking at my current level, and that we can work out a couple issues with audit and networking there is a possibility we're looking at mid 2018 for stacking. The increased interest in security module namespaces for containers is helping make stacking seem important to more people. > If it is likely take longer, should I resume proposing CaitSith for now > as one of "Minor modules" except security_module_enable() check added > until Security Module Stacking work completes? Or should I wait for > completion of stacking work? I want to know it, for recent proposals are > rather staying silent. I wouldn't wait if it was my project, but I have been known to be more aggressive than is good for me from time to time. > Regards. > -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html