From: Roberto Sassu <roberto.sassu@huaweicloud.com>
To: Paul Moore <paul@paul-moore.com>
Cc: zohar@linux.ibm.com, dmitry.kasatkin@gmail.com,
jmorris@namei.org, serge@hallyn.com,
stephen.smalley.work@gmail.com, eparis@parisplace.org,
casey@schaufler-ca.com, linux-kernel@vger.kernel.org,
linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org,
bpf@vger.kernel.org, kpsingh@kernel.org, keescook@chromium.org,
nicolas.bouchinet@clip-os.org,
Roberto Sassu <roberto.sassu@huawei.com>
Subject: Re: [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes
Date: Sat, 10 Jun 2023 10:00:57 +0200 [thread overview]
Message-ID: <dca634f0-ca7d-1876-0702-6ecc194ac47d@huaweicloud.com> (raw)
In-Reply-To: <CAHC9VhSzC0zV31XrEz06HKp=NNbz0XPT24ja0O1sZtNM_aXqHg@mail.gmail.com>
On 6/9/2023 10:05 PM, Paul Moore wrote:
> On Sat, Jun 3, 2023 at 3:16 PM Roberto Sassu
> <roberto.sassu@huaweicloud.com> wrote:
>>
>> From: Roberto Sassu <roberto.sassu@huawei.com>
>>
>> One of the major goals of LSM stacking is to run multiple LSMs side by side
>> without interfering with each other. The ultimate decision will depend on
>> individual LSM decision.
>>
>> Several changes need to be made to the LSM infrastructure to be able to
>> support that. This patch set tackles one of them: gives to each LSM the
>> ability to specify one or multiple xattrs to be set at inode creation
>> time and, at the same time, gives to EVM the ability to access all those
>> xattrs and calculate the HMAC on them ...
>
> Thanks for sticking with this Roberto, I see a few
> comments/suggestions on this patchset, but overall it is looking
> pretty good; I'm hopeful we will be able to merge the next revision.
Thanks for looking at it.
Just sent v12 with the suggestions. One is addressed with a different
patch set (Smack transmute fixes).
Roberto
prev parent reply other threads:[~2023-06-10 8:01 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-03 19:15 [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Roberto Sassu
2023-06-03 19:15 ` [PATCH v11 1/4] security: Allow all LSMs to provide xattrs for inode_init_security hook Roberto Sassu
2023-06-09 20:02 ` Paul Moore
2023-06-03 19:15 ` [PATCH v11 2/4] smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security() Roberto Sassu
2023-06-05 8:38 ` Roberto Sassu
2023-06-09 7:26 ` Jarkko Sakkinen
2023-06-10 7:01 ` Roberto Sassu
2023-06-23 19:32 ` Mengchi Cheng
2023-06-09 19:35 ` Mimi Zohar
2023-06-10 7:09 ` Roberto Sassu
2023-06-03 19:15 ` [PATCH v11 3/4] evm: Align evm_inode_init_security() definition with LSM infrastructure Roberto Sassu
2023-06-09 19:48 ` Mimi Zohar
2023-06-03 19:15 ` [PATCH v11 4/4] evm: Support multiple LSMs providing an xattr Roberto Sassu
2023-06-06 16:09 ` [PATCH v11 0/4] evm: Do HMAC of multiple per LSM xattrs for new inodes Mimi Zohar
2023-06-06 16:16 ` Roberto Sassu
2023-06-09 20:05 ` Paul Moore
2023-06-10 8:00 ` Roberto Sassu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dca634f0-ca7d-1876-0702-6ecc194ac47d@huaweicloud.com \
--to=roberto.sassu@huaweicloud.com \
--cc=bpf@vger.kernel.org \
--cc=casey@schaufler-ca.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=eparis@parisplace.org \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=kpsingh@kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=nicolas.bouchinet@clip-os.org \
--cc=paul@paul-moore.com \
--cc=roberto.sassu@huawei.com \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=stephen.smalley.work@gmail.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.