From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: Re: [PATCH security-next v4 23/32] selinux: Remove boot parameter Date: Tue, 2 Oct 2018 17:12:58 -0700 Message-ID: References: <20181002005505.6112-1-keescook@chromium.org> <20181002005505.6112-24-keescook@chromium.org> <785ef6a9-ae46-3533-0348-74bcf6f10928@tycho.nsa.gov> <809f1cfd-077b-ee58-51ba-b22daf46d12b@tycho.nsa.gov> <5955f5ce-b803-4f58-8b07-54c291e33da5@canonical.com> <3b539d37-136f-b868-3155-f2982eb63890@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: In-Reply-To: <3b539d37-136f-b868-3155-f2982eb63890@canonical.com> Sender: linux-kernel-owner@vger.kernel.org To: John Johansen Cc: James Morris , Jordan Glover , Stephen Smalley , Paul Moore , Casey Schaufler , Tetsuo Handa , "Schaufler, Casey" , linux-security-module , Jonathan Corbet , "open list:DOCUMENTATION" , linux-arch , LKML List-Id: linux-arch.vger.kernel.org On Tue, Oct 2, 2018 at 5:05 PM, John Johansen wrote: > On 10/02/2018 04:54 PM, Kees Cook wrote: >> That's not how I have it currently. It's a comma-separated a string, >> including the reserved name "all". The default would just be >> "CONFIG_LSM_ENABLE=all". Casey and I wanted this to have a way to >> capture new LSMs by default at build-time. >> > > I understand where you are coming from, but speaking with my distro > hat on, that is not going to work. As a distro Ubuntu very much wants > to be able to offer all the LSMs built in to the kernel so the user > can select them. But very much wants to be able to specify a default > supported subset that is enabled at boot. > > I expect RH and Suse will feel similarily. Speaking for Ubuntu if this > isn't available as part of lsm stacking it will get distro patched in. Right. Ubuntu would do something like: CONFIG_LSM_ENABLE=yama,apparmor,integrity And that's why I wanted non-explicit lsm.enable, so that an end user could just do: lsm.enable=loadpin to add loadpin. Perhaps we could have both? "lsm.enable=+loadpin" (add loadpin to build default list) vs "lsm.enable=loadpin" (override build default list with ONLY loadpin). -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-yb1-f196.google.com ([209.85.219.196]:38445 "EHLO mail-yb1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726613AbeJCG67 (ORCPT ); Wed, 3 Oct 2018 02:58:59 -0400 Received: by mail-yb1-f196.google.com with SMTP id e190-v6so1629826ybb.5 for ; Tue, 02 Oct 2018 17:13:03 -0700 (PDT) Received: from mail-yw1-f54.google.com (mail-yw1-f54.google.com. [209.85.161.54]) by smtp.gmail.com with ESMTPSA id x64-v6sm5624592ywx.103.2018.10.02.17.12.59 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Oct 2018 17:12:59 -0700 (PDT) Received: by mail-yw1-f54.google.com with SMTP id v1-v6so1572605ywv.6 for ; Tue, 02 Oct 2018 17:12:59 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <3b539d37-136f-b868-3155-f2982eb63890@canonical.com> References: <20181002005505.6112-1-keescook@chromium.org> <20181002005505.6112-24-keescook@chromium.org> <785ef6a9-ae46-3533-0348-74bcf6f10928@tycho.nsa.gov> <809f1cfd-077b-ee58-51ba-b22daf46d12b@tycho.nsa.gov> <5955f5ce-b803-4f58-8b07-54c291e33da5@canonical.com> <3b539d37-136f-b868-3155-f2982eb63890@canonical.com> From: Kees Cook Date: Tue, 2 Oct 2018 17:12:58 -0700 Message-ID: Subject: Re: [PATCH security-next v4 23/32] selinux: Remove boot parameter Content-Type: text/plain; charset="UTF-8" Sender: linux-arch-owner@vger.kernel.org List-ID: To: John Johansen Cc: James Morris , Jordan Glover , Stephen Smalley , Paul Moore , Casey Schaufler , Tetsuo Handa , "Schaufler, Casey" , linux-security-module , Jonathan Corbet , "open list:DOCUMENTATION" , linux-arch , LKML Message-ID: <20181003001258.__ajPrBEJAlmkd4CnmjddIF0os8QoddqeQprm51Hzm8@z> On Tue, Oct 2, 2018 at 5:05 PM, John Johansen wrote: > On 10/02/2018 04:54 PM, Kees Cook wrote: >> That's not how I have it currently. It's a comma-separated a string, >> including the reserved name "all". The default would just be >> "CONFIG_LSM_ENABLE=all". Casey and I wanted this to have a way to >> capture new LSMs by default at build-time. >> > > I understand where you are coming from, but speaking with my distro > hat on, that is not going to work. As a distro Ubuntu very much wants > to be able to offer all the LSMs built in to the kernel so the user > can select them. But very much wants to be able to specify a default > supported subset that is enabled at boot. > > I expect RH and Suse will feel similarily. Speaking for Ubuntu if this > isn't available as part of lsm stacking it will get distro patched in. Right. Ubuntu would do something like: CONFIG_LSM_ENABLE=yama,apparmor,integrity And that's why I wanted non-explicit lsm.enable, so that an end user could just do: lsm.enable=loadpin to add loadpin. Perhaps we could have both? "lsm.enable=+loadpin" (add loadpin to build default list) vs "lsm.enable=loadpin" (override build default list with ONLY loadpin). -Kees -- Kees Cook Pixel Security