From mboxrd@z Thu Jan 1 00:00:00 1970 From: John Johansen Subject: Re: [PATCH security-next v4 23/32] selinux: Remove boot parameter Date: Wed, 3 Oct 2018 06:15:54 -0700 Message-ID: References: <20181002005505.6112-1-keescook@chromium.org> <785ef6a9-ae46-3533-0348-74bcf6f10928@tycho.nsa.gov> <809f1cfd-077b-ee58-51ba-b22daf46d12b@tycho.nsa.gov> <5955f5ce-b803-4f58-8b07-54c291e33da5@canonical.com> <3b539d37-136f-b868-3155-f2982eb63890@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Content-Language: en-GB Sender: linux-kernel-owner@vger.kernel.org To: Kees Cook Cc: James Morris , Jordan Glover , Stephen Smalley , Paul Moore , Casey Schaufler , Tetsuo Handa , "Schaufler, Casey" , linux-security-module , Jonathan Corbet , "open list:DOCUMENTATION" , linux-arch , LKML List-Id: linux-arch.vger.kernel.org On 10/02/2018 05:12 PM, Kees Cook wrote: > On Tue, Oct 2, 2018 at 5:05 PM, John Johansen > wrote: >> On 10/02/2018 04:54 PM, Kees Cook wrote: >>> That's not how I have it currently. It's a comma-separated a string, >>> including the reserved name "all". The default would just be >>> "CONFIG_LSM_ENABLE=all". Casey and I wanted this to have a way to >>> capture new LSMs by default at build-time. >>> >> >> I understand where you are coming from, but speaking with my distro >> hat on, that is not going to work. As a distro Ubuntu very much wants >> to be able to offer all the LSMs built in to the kernel so the user >> can select them. But very much wants to be able to specify a default >> supported subset that is enabled at boot. >> >> I expect RH and Suse will feel similarily. Speaking for Ubuntu if this >> isn't available as part of lsm stacking it will get distro patched in. > > Right. Ubuntu would do something like: > > CONFIG_LSM_ENABLE=yama,apparmor,integrity > > And that's why I wanted non-explicit lsm.enable, so that an end user > could just do: > > lsm.enable=loadpin > > to add loadpin. > > Perhaps we could have both? "lsm.enable=+loadpin" (add loadpin to > build default list) vs "lsm.enable=loadpin" (override build default > list with ONLY loadpin). > Maybe? I'm not sure what the best option is with all the competing requirements/desires. I need to think about it more and would like to see what others think. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from youngberry.canonical.com ([91.189.89.112]:33514 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726630AbeJCUE0 (ORCPT ); Wed, 3 Oct 2018 16:04:26 -0400 Subject: Re: [PATCH security-next v4 23/32] selinux: Remove boot parameter References: <20181002005505.6112-1-keescook@chromium.org> <785ef6a9-ae46-3533-0348-74bcf6f10928@tycho.nsa.gov> <809f1cfd-077b-ee58-51ba-b22daf46d12b@tycho.nsa.gov> <5955f5ce-b803-4f58-8b07-54c291e33da5@canonical.com> <3b539d37-136f-b868-3155-f2982eb63890@canonical.com> From: John Johansen Message-ID: Date: Wed, 3 Oct 2018 06:15:54 -0700 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 7bit Sender: linux-arch-owner@vger.kernel.org List-ID: To: Kees Cook Cc: James Morris , Jordan Glover , Stephen Smalley , Paul Moore , Casey Schaufler , Tetsuo Handa , "Schaufler, Casey" , linux-security-module , Jonathan Corbet , "open list:DOCUMENTATION" , linux-arch , LKML Message-ID: <20181003131554.AyW2Tjvh_gjIvkeyc8FFGb3ZZEONYW6ONNgv1asI6gs@z> On 10/02/2018 05:12 PM, Kees Cook wrote: > On Tue, Oct 2, 2018 at 5:05 PM, John Johansen > wrote: >> On 10/02/2018 04:54 PM, Kees Cook wrote: >>> That's not how I have it currently. It's a comma-separated a string, >>> including the reserved name "all". The default would just be >>> "CONFIG_LSM_ENABLE=all". Casey and I wanted this to have a way to >>> capture new LSMs by default at build-time. >>> >> >> I understand where you are coming from, but speaking with my distro >> hat on, that is not going to work. As a distro Ubuntu very much wants >> to be able to offer all the LSMs built in to the kernel so the user >> can select them. But very much wants to be able to specify a default >> supported subset that is enabled at boot. >> >> I expect RH and Suse will feel similarily. Speaking for Ubuntu if this >> isn't available as part of lsm stacking it will get distro patched in. > > Right. Ubuntu would do something like: > > CONFIG_LSM_ENABLE=yama,apparmor,integrity > > And that's why I wanted non-explicit lsm.enable, so that an end user > could just do: > > lsm.enable=loadpin > > to add loadpin. > > Perhaps we could have both? "lsm.enable=+loadpin" (add loadpin to > build default list) vs "lsm.enable=loadpin" (override build default > list with ONLY loadpin). > Maybe? I'm not sure what the best option is with all the competing requirements/desires. I need to think about it more and would like to see what others think.