From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: Re: [PATCH security-next v4 21/32] LSM: Finalize centralized LSM enabling logic Date: Mon, 1 Oct 2018 21:49:37 -0700 Message-ID: References: <20181002005505.6112-1-keescook@chromium.org> <20181002005505.6112-22-keescook@chromium.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Randy Dunlap Cc: James Morris , Casey Schaufler , John Johansen , Tetsuo Handa , Paul Moore , Stephen Smalley , "Schaufler, Casey" , LSM , Jonathan Corbet , "open list:DOCUMENTATION" , linux-arch , LKML List-Id: linux-arch.vger.kernel.org On Mon, Oct 1, 2018 at 6:18 PM, Randy Dunlap wrote: > On 10/1/18 5:54 PM, Kees Cook wrote: >> Prior to this patch, default "enable" behavior was unchanged: SELinux >> and AppArmor were controlled separately from the centralized control >> defined by CONFIG_LSM_ENABLE and "lsm.enable=...". This changes the >> logic to give all control over to the central logic. >> >> Instead of allowing SELinux and AppArmor to override the central LSM >> enabling logic, by having separate CONFIG and boot parameters, this >> forces all "enable" variables to disabled, then enables any listed in >> the CONFIG_LSM_ENABLE and "lsm.enable=..." settings, and finally disables >> any listed in "lsm.disable=...". >> >> Signed-off-by: Kees Cook >> --- >> .../admin-guide/kernel-parameters.txt | 6 ++-- >> include/linux/lsm_hooks.h | 2 +- >> security/security.c | 32 +++++++------------ >> 3 files changed, 15 insertions(+), 25 deletions(-) >> >> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt >> index 67c90985d2b8..f646cfab5613 100644 >> --- a/Documentation/admin-guide/kernel-parameters.txt >> +++ b/Documentation/admin-guide/kernel-parameters.txt >> @@ -2279,14 +2279,12 @@ >> lsm.disable=lsm1,...,lsmN >> [SECURITY] Comma-separated list of LSMs to disable >> at boot time. This overrides "lsm.enable=", > > better: This overrides "lsm.enable=" and Eek, yes! Thank you. :) -Kees > >> - CONFIG_LSM_ENABLE, and any per-LSM CONFIGs and boot >> - parameters. >> + CONFIG_LSM_ENABLE. >> >> lsm.enable=lsm1,...,lsmN >> [SECURITY] Comma-separated list of LSMs to enable >> at boot time. This overrides any omissions from >> - CONFIG_LSM_ENABLE, and any per-LSM CONFIGs and >> - boot parameters. >> + CONFIG_LSM_ENABLE. >> >> machvec= [IA-64] Force the use of a particular machine-vector >> (machvec) in a generic kernel. > > > -- > ~Randy -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-yw1-f67.google.com ([209.85.161.67]:46667 "EHLO mail-yw1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726529AbeJBLa6 (ORCPT ); Tue, 2 Oct 2018 07:30:58 -0400 Received: by mail-yw1-f67.google.com with SMTP id j202-v6so255796ywa.13 for ; Mon, 01 Oct 2018 21:49:41 -0700 (PDT) Received: from mail-yw1-f41.google.com (mail-yw1-f41.google.com. [209.85.161.41]) by smtp.gmail.com with ESMTPSA id e82-v6sm14022145ywa.60.2018.10.01.21.49.38 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 01 Oct 2018 21:49:39 -0700 (PDT) Received: by mail-yw1-f41.google.com with SMTP id j202-v6so255764ywa.13 for ; Mon, 01 Oct 2018 21:49:38 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: <20181002005505.6112-1-keescook@chromium.org> <20181002005505.6112-22-keescook@chromium.org> From: Kees Cook Date: Mon, 1 Oct 2018 21:49:37 -0700 Message-ID: Subject: Re: [PATCH security-next v4 21/32] LSM: Finalize centralized LSM enabling logic Content-Type: text/plain; charset="UTF-8" Sender: linux-arch-owner@vger.kernel.org List-ID: To: Randy Dunlap Cc: James Morris , Casey Schaufler , John Johansen , Tetsuo Handa , Paul Moore , Stephen Smalley , "Schaufler, Casey" , LSM , Jonathan Corbet , "open list:DOCUMENTATION" , linux-arch , LKML Message-ID: <20181002044937.d_7yG4llSWq0duSynsQ7VuDE_xN1tecrhIClhkhMc0I@z> On Mon, Oct 1, 2018 at 6:18 PM, Randy Dunlap wrote: > On 10/1/18 5:54 PM, Kees Cook wrote: >> Prior to this patch, default "enable" behavior was unchanged: SELinux >> and AppArmor were controlled separately from the centralized control >> defined by CONFIG_LSM_ENABLE and "lsm.enable=...". This changes the >> logic to give all control over to the central logic. >> >> Instead of allowing SELinux and AppArmor to override the central LSM >> enabling logic, by having separate CONFIG and boot parameters, this >> forces all "enable" variables to disabled, then enables any listed in >> the CONFIG_LSM_ENABLE and "lsm.enable=..." settings, and finally disables >> any listed in "lsm.disable=...". >> >> Signed-off-by: Kees Cook >> --- >> .../admin-guide/kernel-parameters.txt | 6 ++-- >> include/linux/lsm_hooks.h | 2 +- >> security/security.c | 32 +++++++------------ >> 3 files changed, 15 insertions(+), 25 deletions(-) >> >> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt >> index 67c90985d2b8..f646cfab5613 100644 >> --- a/Documentation/admin-guide/kernel-parameters.txt >> +++ b/Documentation/admin-guide/kernel-parameters.txt >> @@ -2279,14 +2279,12 @@ >> lsm.disable=lsm1,...,lsmN >> [SECURITY] Comma-separated list of LSMs to disable >> at boot time. This overrides "lsm.enable=", > > better: This overrides "lsm.enable=" and Eek, yes! Thank you. :) -Kees > >> - CONFIG_LSM_ENABLE, and any per-LSM CONFIGs and boot >> - parameters. >> + CONFIG_LSM_ENABLE. >> >> lsm.enable=lsm1,...,lsmN >> [SECURITY] Comma-separated list of LSMs to enable >> at boot time. This overrides any omissions from >> - CONFIG_LSM_ENABLE, and any per-LSM CONFIGs and >> - boot parameters. >> + CONFIG_LSM_ENABLE. >> >> machvec= [IA-64] Force the use of a particular machine-vector >> (machvec) in a generic kernel. > > > -- > ~Randy -- Kees Cook Pixel Security