From: Paul Moore via Ocfs2-devel <ocfs2-devel@oss.oracle.com> To: Roberto Sassu <roberto.sassu@huaweicloud.com> Cc: nicolas.bouchinet@clip-os.org, linux-kernel@vger.kernel.org, keescook@chromium.org, selinux@vger.kernel.org, dmitry.kasatkin@gmail.com, Roberto Sassu <roberto.sassu@huawei.com>, jmorris@namei.org, zohar@linux.ibm.com, reiserfs-devel@vger.kernel.org, linux-security-module@vger.kernel.org, casey@schaufler-ca.com, eparis@parisplace.org, linux-integrity@vger.kernel.org, stephen.smalley.work@gmail.com, ocfs2-devel@oss.oracle.com, serge@hallyn.com Subject: Re: [Ocfs2-devel] [PATCH v7 0/6] evm: Do HMAC of multiple per LSM xattrs for new inodes Date: Thu, 12 Jan 2023 12:15:51 -0500 [thread overview] Message-ID: <CAHC9VhS0SnEb46-FBpn2JpC2dJ7OnkeJ2EtLBvVvkOLdfFmcbg@mail.gmail.com> (raw) In-Reply-To: <20221201104125.919483-1-roberto.sassu@huaweicloud.com> On Thu, Dec 1, 2022 at 5:42 AM Roberto Sassu <roberto.sassu@huaweicloud.com> wrote: > > From: Roberto Sassu <roberto.sassu@huawei.com> > > One of the major goals of LSM stacking is to run multiple LSMs side by side > without interfering with each other. The ultimate decision will depend on > individual LSM decision. > > Several changes need to be made to the LSM infrastructure to be able to > support that. This patch set tackles one of them: gives to each LSM the > ability to specify one or multiple xattrs to be set at inode creation > time and, at the same time, gives to EVM the ability to access all those > xattrs and calculate the HMAC on them. ... > The patch set has been tested with both the SElinux and Smack test suites. > Below, there is the summary of the test results: > > SELinux Test Suite result (without patches): > Files=73, Tests=1346, 225 wallclock secs ( 0.43 usr 0.23 sys + 6.11 cusr 58.70 csys = 65.47 CPU) > Result: FAIL > Failed 4/73 test programs. 13/1346 subtests failed. > > SELinux Test Suite result (with patches): > Files=73, Tests=1346, 225 wallclock secs ( 0.44 usr 0.22 sys + 6.15 cusr 59.94 csys = 66.75 CPU) > Result: FAIL > Failed 4/73 test programs. 13/1346 subtests failed. Can you provide some more information on which of the selinux-testsuite tests failed? That shouldn't be happening and I'm a little concerned that these test failures, even if unrelated to your work here, could be masking failures which are related. -- paul-moore.com _______________________________________________ Ocfs2-devel mailing list Ocfs2-devel@oss.oracle.com https://oss.oracle.com/mailman/listinfo/ocfs2-devel
WARNING: multiple messages have this Message-ID (diff)
From: Paul Moore <paul@paul-moore.com> To: Roberto Sassu <roberto.sassu@huaweicloud.com> Cc: mark@fasheh.com, jlbec@evilplan.org, joseph.qi@linux.alibaba.com, zohar@linux.ibm.com, dmitry.kasatkin@gmail.com, jmorris@namei.org, serge@hallyn.com, stephen.smalley.work@gmail.com, eparis@parisplace.org, casey@schaufler-ca.com, ocfs2-devel@oss.oracle.com, reiserfs-devel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, linux-kernel@vger.kernel.org, keescook@chromium.org, nicolas.bouchinet@clip-os.org, Roberto Sassu <roberto.sassu@huawei.com> Subject: Re: [PATCH v7 0/6] evm: Do HMAC of multiple per LSM xattrs for new inodes Date: Thu, 12 Jan 2023 12:15:51 -0500 [thread overview] Message-ID: <CAHC9VhS0SnEb46-FBpn2JpC2dJ7OnkeJ2EtLBvVvkOLdfFmcbg@mail.gmail.com> (raw) In-Reply-To: <20221201104125.919483-1-roberto.sassu@huaweicloud.com> On Thu, Dec 1, 2022 at 5:42 AM Roberto Sassu <roberto.sassu@huaweicloud.com> wrote: > > From: Roberto Sassu <roberto.sassu@huawei.com> > > One of the major goals of LSM stacking is to run multiple LSMs side by side > without interfering with each other. The ultimate decision will depend on > individual LSM decision. > > Several changes need to be made to the LSM infrastructure to be able to > support that. This patch set tackles one of them: gives to each LSM the > ability to specify one or multiple xattrs to be set at inode creation > time and, at the same time, gives to EVM the ability to access all those > xattrs and calculate the HMAC on them. ... > The patch set has been tested with both the SElinux and Smack test suites. > Below, there is the summary of the test results: > > SELinux Test Suite result (without patches): > Files=73, Tests=1346, 225 wallclock secs ( 0.43 usr 0.23 sys + 6.11 cusr 58.70 csys = 65.47 CPU) > Result: FAIL > Failed 4/73 test programs. 13/1346 subtests failed. > > SELinux Test Suite result (with patches): > Files=73, Tests=1346, 225 wallclock secs ( 0.44 usr 0.22 sys + 6.15 cusr 59.94 csys = 66.75 CPU) > Result: FAIL > Failed 4/73 test programs. 13/1346 subtests failed. Can you provide some more information on which of the selinux-testsuite tests failed? That shouldn't be happening and I'm a little concerned that these test failures, even if unrelated to your work here, could be masking failures which are related. -- paul-moore.com
next prev parent reply other threads:[~2023-01-12 17:16 UTC|newest] Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-12-01 10:41 [PATCH v7 0/6] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu 2022-12-01 10:41 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2022-12-01 10:41 ` [PATCH v7 1/6] reiserfs: Switch to security_inode_init_security() Roberto Sassu 2022-12-01 10:41 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2023-02-17 19:47 ` Mimi Zohar 2023-02-17 19:47 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2022-12-01 10:41 ` [Ocfs2-devel] [PATCH v7 2/6] ocfs2: " Roberto Sassu via Ocfs2-devel 2022-12-01 10:41 ` Roberto Sassu 2023-01-10 8:55 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2023-01-10 8:55 ` Roberto Sassu 2023-01-12 17:21 ` [Ocfs2-devel] " Paul Moore via Ocfs2-devel 2023-01-12 17:21 ` Paul Moore 2023-02-08 14:33 ` Roberto Sassu 2023-02-08 14:33 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2023-02-09 21:05 ` Paul Moore 2023-02-09 21:05 ` [Ocfs2-devel] " Paul Moore via Ocfs2-devel 2023-02-21 6:45 ` Joseph Qi 2023-02-21 6:45 ` [Ocfs2-devel] " Joseph Qi via Ocfs2-devel 2023-02-21 7:51 ` Roberto Sassu 2023-02-21 7:51 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2023-02-17 19:51 ` Mimi Zohar 2023-02-17 19:51 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2023-02-17 21:30 ` Mimi Zohar 2023-02-17 21:30 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2023-02-20 9:27 ` Roberto Sassu 2023-02-20 9:27 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2023-02-20 11:08 ` Mimi Zohar 2023-02-20 11:08 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2023-02-20 12:20 ` Roberto Sassu 2023-02-20 12:20 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2023-02-20 12:40 ` Mimi Zohar 2023-02-20 12:40 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2023-02-20 8:34 ` Roberto Sassu 2023-02-20 8:34 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2022-12-01 10:41 ` [Ocfs2-devel] [PATCH v7 3/6] security: Remove security_old_inode_init_security() Roberto Sassu via Ocfs2-devel 2022-12-01 10:41 ` Roberto Sassu 2023-02-19 19:41 ` Mimi Zohar 2023-02-19 19:41 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2022-12-01 10:41 ` [Ocfs2-devel] [PATCH v7 4/6] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu via Ocfs2-devel 2022-12-01 10:41 ` Roberto Sassu 2023-02-20 12:43 ` Mimi Zohar 2023-02-20 12:43 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2022-12-01 10:41 ` [Ocfs2-devel] [PATCH v7 5/6] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu via Ocfs2-devel 2022-12-01 10:41 ` Roberto Sassu 2023-02-19 19:41 ` Mimi Zohar 2023-02-19 19:41 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2022-12-01 10:41 ` [Ocfs2-devel] [PATCH v7 6/6] evm: Support multiple LSMs providing an xattr Roberto Sassu via Ocfs2-devel 2022-12-01 10:41 ` Roberto Sassu 2023-02-19 19:42 ` Mimi Zohar 2023-02-19 19:42 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2023-02-20 9:49 ` Roberto Sassu 2023-02-20 9:49 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2023-02-20 10:56 ` Mimi Zohar 2023-02-20 10:56 ` [Ocfs2-devel] " Mimi Zohar via Ocfs2-devel 2023-01-12 17:15 ` Paul Moore via Ocfs2-devel [this message] 2023-01-12 17:15 ` [PATCH v7 0/6] evm: Do HMAC of multiple per LSM xattrs for new inodes Paul Moore 2023-01-13 10:35 ` [Ocfs2-devel] " Roberto Sassu via Ocfs2-devel 2023-01-13 10:35 ` Roberto Sassu 2023-03-08 22:16 ` Paul Moore 2023-03-08 22:16 ` Paul Moore 2023-03-08 22:16 ` [Ocfs2-devel] " Paul Moore via Ocfs2-devel 2023-03-09 7:53 ` Roberto Sassu via Ocfs2-devel 2023-03-09 7:53 ` Roberto Sassu 2023-03-09 7:53 ` Roberto Sassu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAHC9VhS0SnEb46-FBpn2JpC2dJ7OnkeJ2EtLBvVvkOLdfFmcbg@mail.gmail.com \ --to=ocfs2-devel@oss.oracle.com \ --cc=casey@schaufler-ca.com \ --cc=dmitry.kasatkin@gmail.com \ --cc=eparis@parisplace.org \ --cc=jmorris@namei.org \ --cc=keescook@chromium.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=nicolas.bouchinet@clip-os.org \ --cc=paul@paul-moore.com \ --cc=reiserfs-devel@vger.kernel.org \ --cc=roberto.sassu@huawei.com \ --cc=roberto.sassu@huaweicloud.com \ --cc=selinux@vger.kernel.org \ --cc=serge@hallyn.com \ --cc=stephen.smalley.work@gmail.com \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.