Linux-Security-Module Archive on lore.kernel.org
 help / color / Atom feed
From: Casey Schaufler <casey@schaufler-ca.com>
To: James Morris <jmorris@namei.org>
Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>,
	linux-kernel@vger.kernel.org,
	Peter Zijlstra <peterz@infradead.org>,
	rostedt@goodmis.org, primiano@google.com, rsavitski@google.com,
	jeffv@google.com, kernel-team@android.com,
	Alexei Starovoitov <ast@kernel.org>,
	Arnaldo Carvalho de Melo <acme@kernel.org>,
	bpf@vger.kernel.org, Daniel Borkmann <daniel@iogearbox.net>,
	Ingo Molnar <mingo@redhat.com>, Jiri Olsa <jolsa@redhat.com>,
	Kees Cook <keescook@chromium.org>,
	linux-security-module@vger.kernel.org,
	Matthew Garrett <matthewgarrett@google.com>,
	Namhyung Kim <namhyung@kernel.org>,
	selinux@vger.kernel.org, Song Liu <songliubraving@fb.com>,
	"maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)"
	<x86@kernel.org>, Yonghong Song <yhs@fb.com>,
	casey@schaufler-ca.com
Subject: Re: [PATCH RFC] perf_event: Add support for LSM and SELinux checks
Date: Wed, 9 Oct 2019 15:41:56 -0700
Message-ID: <2b94802d-12ea-4f2d-bb65-eda3b3542bb2@schaufler-ca.com> (raw)
In-Reply-To: <alpine.LRH.2.21.1910100912210.29840@namei.org>

On 10/9/2019 3:14 PM, James Morris wrote:
> On Wed, 9 Oct 2019, Casey Schaufler wrote:
>
>> Please consider making the perf_alloc security blob maintained
>> by the infrastructure rather than the individual modules. This
>> will save it having to be changed later.
> Is anyone planning on using this with full stacking?
>
> If not, we don't need the extra code & complexity. Stacking should only 
> cover what's concretely required by in-tree users.

I don't believe it's any simpler for SELinux to do the allocation
than for the infrastructure to do it. I don't see anyone's head
exploding over the existing infrastructure allocation of blobs.
We're likely to want it at some point, so why not avoid the hassle
and delay by doing it the "new" way up front?



  reply index

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-09 20:36 Joel Fernandes (Google)
2019-10-09 21:55 ` Casey Schaufler
2019-10-09 22:14   ` James Morris
2019-10-09 22:41     ` Casey Schaufler [this message]
2019-10-10  0:40       ` Joel Fernandes
2019-10-10  0:53         ` Casey Schaufler
2019-10-10  2:44       ` James Morris
2019-10-10 18:12         ` Casey Schaufler
2019-10-10 19:41           ` James Morris
2019-10-09 22:11 ` James Morris
2019-10-10  0:43   ` Joel Fernandes
2019-10-10  7:23 ` Alexey Budankov
2019-10-10  8:12 ` Peter Zijlstra
2019-10-10 15:13   ` Joel Fernandes
2019-10-10 17:09     ` Peter Zijlstra
2019-10-10 18:31       ` Joel Fernandes
2019-10-11  7:05         ` Peter Zijlstra
2019-10-11 15:47           ` Joel Fernandes

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2b94802d-12ea-4f2d-bb65-eda3b3542bb2@schaufler-ca.com \
    --to=casey@schaufler-ca.com \
    --cc=acme@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=jeffv@google.com \
    --cc=jmorris@namei.org \
    --cc=joel@joelfernandes.org \
    --cc=jolsa@redhat.com \
    --cc=keescook@chromium.org \
    --cc=kernel-team@android.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=matthewgarrett@google.com \
    --cc=mingo@redhat.com \
    --cc=namhyung@kernel.org \
    --cc=peterz@infradead.org \
    --cc=primiano@google.com \
    --cc=rostedt@goodmis.org \
    --cc=rsavitski@google.com \
    --cc=selinux@vger.kernel.org \
    --cc=songliubraving@fb.com \
    --cc=x86@kernel.org \
    --cc=yhs@fb.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org
	public-inbox-index linux-security-module

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git