From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-yb1-f172.google.com ([209.85.219.172]:45896 "EHLO mail-yb1-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727484AbeJDXMn (ORCPT ); Thu, 4 Oct 2018 19:12:43 -0400 Received: by mail-yb1-f172.google.com with SMTP id d9-v6so4124532ybr.12 for ; Thu, 04 Oct 2018 09:18:44 -0700 (PDT) Received: from mail-yw1-f47.google.com (mail-yw1-f47.google.com. [209.85.161.47]) by smtp.gmail.com with ESMTPSA id k85-v6sm2276370ywa.76.2018.10.04.09.18.41 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 04 Oct 2018 09:18:42 -0700 (PDT) Received: by mail-yw1-f47.google.com with SMTP id q129-v6so3984192ywg.8 for ; Thu, 04 Oct 2018 09:18:41 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: <20181002005505.6112-1-keescook@chromium.org> <809f1cfd-077b-ee58-51ba-b22daf46d12b@tycho.nsa.gov> <5955f5ce-b803-4f58-8b07-54c291e33da5@canonical.com> From: Kees Cook Date: Thu, 4 Oct 2018 09:18:40 -0700 Message-ID: Subject: Re: [PATCH security-next v4 23/32] selinux: Remove boot parameter Content-Type: text/plain; charset="UTF-8" Sender: linux-arch-owner@vger.kernel.org List-ID: To: John Johansen , James Morris Cc: Jordan Glover , Stephen Smalley , Paul Moore , Casey Schaufler , Tetsuo Handa , "Schaufler, Casey" , linux-security-module , Jonathan Corbet , "open list:DOCUMENTATION" , linux-arch , LKML Message-ID: <20181004161840._qcqS3OlmepsiOGrpZONimAYVVaf6RKr266dFVKKqRg@z> On Wed, Oct 3, 2018 at 10:56 PM, John Johansen wrote: > On 10/03/2018 01:36 PM, Kees Cook wrote: >> I still think we should have all built LSMs enabled by default, with >> CONFIG_LSM_DISABLE available to turn stuff off. CONFIG_LSM_ORDER > > and this as a distro ubuntu does not want. > Ubuntu wants to make yes available by building them in, but does NOT > want all the LSM enabled by default, not even necessarily all minor LSMs. > > As a distro we want a supported set as default, and users can opt-in > to new LSMs. If a new LSM comes along we don't want it enabled by > default, which happens Using the lsm disable approach. Okay, but order still matters. Where, in the order, should a disabled LSM go? It seems like the friendliest approach for an end-user would be to do something like lsm=+landlock and it all works correctly. That user doesn't need to know about ordering or the distro default LSMs. They just want to _add_ landlock. They want all the other LSMs to still be present, and they want the distro to have chosen where landlock is in the ordering. >> I should also note that I don't want to leave CONFIG_DEFAULT_SECURITY >> in, since it's just a way to disable all the other majors. I don't >> like this because it will force LSMs to be disabled that don't need to >> be once blob-sharing lands. The whole point of this series is to get >> us away from fixed ordering and thinking about "major" vs "minor" and >> towards "exclusive" or not, where we can continue to slowly chip away >> at exclusivity without breaking anything. >> > sure we definitely want to get away form "major" vs "minor" and in > generally even exclusive, except where to LSMs just can't live > with each other. > > But that doesn't mean dropping something like default security. The > mistake with the current DEFAULT_SECURITY was that it only applied > to major LSMs, not the minor ones. Right, we need to expand it to include a full description of ordering and enablement. How about this: CONFIG_LSM specifies order and enablement status. For example: CONFIG_LSM=yama,loadpin,apparmor,!selinux This means init order is yama, loadpin, apparmor, selinux, but selinux is disabled. Anything not listed in CONFIG_LSM but built in will be disabled and ordered in link-order. (i.e. an implicit trailing "!smack,!tomoyo".) Then we add "lsm=" which understands modifiers "-", and "+". "lsm=-apparmor,+selinux" wouldn't change ordering, but would disable apparmor and enable selinux. "lsm=smack,loadpin" would enable only smack and loadpin, in that order and disable everything else. I don't want to overload "security=", but we can if we want. It would be as above, but a trailing comma would be needed to trigger the "ordering" behavior. e.g. "security=selinux" would disable all other majors (retaining the current behavior), but "security=selinux," would disable all other LSMs. -Kees -- Kees Cook Pixel Security