All of lore.kernel.org
 help / color / mirror / Atom feed
From: Paul Moore <paul@paul-moore.com>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: LSM <linux-security-module@vger.kernel.org>,
	James Morris <jmorris@namei.org>,
	John Johansen <john.johansen@canonical.com>,
	Stephen Smalley <sds@tycho.nsa.gov>,
	Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
	Kees Cook <keescook@chromium.org>,
	LKLM <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v4 3/3] LSM: Add context interface for proc attrs
Date: Fri, 24 Jun 2016 15:15:47 -0400	[thread overview]
Message-ID: <CAHC9VhS2oU=YpoWjxAxWJqerQVTE3qcG4qfU7NSTNfqQ=wkW-w@mail.gmail.com> (raw)
In-Reply-To: <5767eed4-78ec-cc4c-2ece-c1fec4d752af@schaufler-ca.com>

On Thu, Jun 23, 2016 at 5:11 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
> Subject: [PATCH v4 3/3] LSM: Add context interface for proc attrs
>
> The /proc/.../attr/current interface is used by all three
> Linux security modules (SELinux, Smack and AppArmor) to
> report and modify the process security attribute. This is
> all fine when there is exactly one of these modules active
> and the userspace code knows which it module it is.
> It would require a major change to the "current" interface
> to provide information about more than one set of process
> security attributes. Instead, a "context" attribute is
> added, which identifies the security module that the
> information applies to. The format is:
>
>         lsmname='context-value'
>
> When multiple concurrent modules are supported the
> /proc/.../attr/context interface will include the data
> for all of the active modules.
>
>         lsmname1='context-value1'lsmname2='context-value2'
>
> The module specific subdirectories under attr contain context
> entries that report the information for that specific module
> in the same format.

I think a delimiter between the different LSMs would be a good idea.
A comma seems like a safe choice at the moment.

-- 
paul moore
www.paul-moore.com

  parent reply	other threads:[~2016-06-24 19:15 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-06-23 21:07 [PATCH v4 0/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-23 21:10 ` [PATCH v4 1/3] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2016-06-24 18:56   ` Paul Moore
2016-06-23 21:11 ` [PATCH v4 2/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-24 19:11   ` Paul Moore
2016-06-24 20:05     ` Casey Schaufler
2016-06-24 20:08       ` Kees Cook
2016-06-24 20:29         ` Paul Moore
2016-06-24 23:26           ` [PATCH v5 0/3] LSM: security module information improvements Casey Schaufler
2016-06-24 23:27             ` [PATCH v5 1/3] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2016-06-29 17:01               ` Paul Moore
2016-07-02 17:21                 ` John Johansen
2016-06-24 23:29             ` [PATCH v5 2/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-29 17:03               ` Paul Moore
2016-07-02 17:24                 ` John Johansen
2016-06-24 23:29             ` [PATCH v4 3/3] LSM: Add context interface for proc attrs Casey Schaufler
2016-06-24 23:38               ` [PATCH v5 " Casey Schaufler
2016-06-29 17:04               ` [PATCH v4 " Paul Moore
2016-07-02 17:25                 ` John Johansen
2016-07-05 15:52                   ` [PATCH v5 0/3] LSM: security module information improvements - Acked Casey Schaufler
2016-07-08 10:05                     ` James Morris
2016-07-08 15:31                       ` Casey Schaufler
2016-07-05 15:52                   ` [PATCH v5 1/3] LSM: Add /sys/kernel/security/lsm " Casey Schaufler
2016-07-05 15:52                   ` [PATCH v5 2/3] LSM: module hierarchy in /proc/.../attr " Casey Schaufler
2016-07-05 15:52                   ` [PATCH v5 3/3] LSM: Add context interface for proc attrs " Casey Schaufler
2016-06-23 21:11 ` [PATCH v4 3/3] LSM: Add context interface for proc attrs Casey Schaufler
2016-06-23 21:49   ` Kees Cook
2016-06-23 22:10     ` Casey Schaufler
2016-06-24 16:38     ` [PATCH v4 4/3] LSM: Improve " Casey Schaufler
2016-06-24 17:48       ` Kees Cook
2016-06-24 19:15   ` Paul Moore [this message]
2016-06-24 19:56     ` [PATCH v4 3/3] LSM: Add " Casey Schaufler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAHC9VhS2oU=YpoWjxAxWJqerQVTE3qcG4qfU7NSTNfqQ=wkW-w@mail.gmail.com' \
    --to=paul@paul-moore.com \
    --cc=casey@schaufler-ca.com \
    --cc=jmorris@namei.org \
    --cc=john.johansen@canonical.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=sds@tycho.nsa.gov \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.