From: John Johansen <john.johansen@canonical.com>
To: James Morris <jmorris@namei.org>,
Casey Schaufler <casey@schaufler-ca.com>
Cc: casey.schaufler@intel.com, linux-security-module@vger.kernel.org,
selinux@vger.kernel.org, keescook@chromium.org,
penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com,
sds@tycho.nsa.gov
Subject: Re: [PATCH v4 23/23] AppArmor: Remove the exclusive flag
Date: Wed, 26 Jun 2019 20:44:37 -0700 [thread overview]
Message-ID: <d89fbbe9-49cb-646e-6cba-7951cf835bf9@canonical.com> (raw)
In-Reply-To: <alpine.LRH.2.21.1906271219450.12379@namei.org>
On 6/26/19 7:22 PM, James Morris wrote:
> On Wed, 26 Jun 2019, Casey Schaufler wrote:
>
>> With the inclusion of the "display" process attribute
>> mechanism AppArmor no longer needs to be treated as an
>> "exclusive" security module. Remove the flag that indicates
>> it is exclusive. Remove the stub getpeersec_dgram AppArmor
>> hook as it has no effect in the single LSM case and
>> interferes in the multiple LSM case.
>
> So now if I build a kernel with SELinux and AppArmor selected, with
> SELinux registered first, I now need to use apparmor=0 at the kernel
> command line to preserve existing behavior (just SELinux running).
>
AppArmor can be built-in (compiled) without being on the Enabled list.
If you had apparmor in your enabled list along with selinux before,
it would attempt to enabled and fail with the message
exclusive disabled: apparmor
now it will be enabled but it does match what is documented in
the lsm enabled description
A comma-separated list of LSMs, in initialization order.
Any LSMs left off this list will be ignored. This can be
controlled at boot with the "lsm=" parameter.
what isn't documented is the exclusive behavior and it does
make sense to have which LSMs are exclusive documented somewhere.
> This should at least be documented.
>
> I wonder if this will break existing users, though. Who has both
> currently selected and depends on only one of them being active?
>
thankfully even if you had apparmor in your lsm enabled list before,
this likely isn't enough to change the system behavior. You will
also need some apparmor policy installed and enough of the
usersoace to load it. Otherwise while apparmor will be enabled it
will come up in unconfined mode.
Even the interfaces /proc/*/attr/* will default to the first
major LSM in the list (in your example selinux). Apparmor's
labeling won't be visible without a task explicitly opting in
to it.
next prev parent reply other threads:[~2019-06-27 3:44 UTC|newest]
Thread overview: 96+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-26 19:22 [PATCH v4 00/23] LSM: Module stacking for AppArmor Casey Schaufler
2019-06-26 19:22 ` [PATCH v4 01/23] LSM: Infrastructure management of the superblock Casey Schaufler
2019-06-26 19:22 ` [PATCH v4 02/23] LSM: Infrastructure management of the sock security Casey Schaufler
2019-06-26 19:22 ` [PATCH v4 03/23] LSM: Infrastructure management of the key blob Casey Schaufler
2019-06-26 19:22 ` [PATCH v4 04/23] LSM: Create and manage the lsmblob data structure Casey Schaufler
2019-06-26 23:39 ` John Johansen
2019-06-27 17:43 ` Casey Schaufler
2019-06-26 19:22 ` [PATCH v4 05/23] LSM: Use lsmblob in security_audit_rule_match Casey Schaufler
2019-06-26 23:07 ` Kees Cook
2019-06-26 23:45 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 06/23] LSM: Use lsmblob in security_kernel_act_as Casey Schaufler
2019-06-26 23:07 ` Kees Cook
2019-06-26 23:47 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 07/23] net: Prepare UDS for secuirty module stacking Casey Schaufler
2019-06-26 23:07 ` Kees Cook
2019-06-26 23:48 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 08/23] LSM: Use lsmblob in security_secctx_to_secid Casey Schaufler
2019-06-26 23:07 ` Kees Cook
2019-06-26 23:50 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 09/23] LSM: Use lsmblob in security_secid_to_secctx Casey Schaufler
2019-06-26 23:07 ` Kees Cook
2019-06-26 23:51 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 10/23] LSM: Use lsmblob in security_ipc_getsecid Casey Schaufler
2019-06-26 23:08 ` Kees Cook
2019-06-26 23:53 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 11/23] LSM: Use lsmblob in security_task_getsecid Casey Schaufler
2019-06-26 23:08 ` Kees Cook
2019-06-26 23:55 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 12/23] LSM: Use lsmblob in security_inode_getsecid Casey Schaufler
2019-06-26 23:08 ` Kees Cook
2019-06-26 23:56 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 13/23] LSM: Use lsmblob in security_cred_getsecid Casey Schaufler
2019-06-26 23:09 ` Kees Cook
2019-06-26 23:57 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 14/23] IMA: Change internal interfaces to use lsmblobs Casey Schaufler
2019-06-26 23:09 ` Kees Cook
2019-06-26 23:58 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 15/23] LSM: Specify which LSM to display Casey Schaufler
2019-06-26 23:12 ` Kees Cook
2019-06-27 21:33 ` John Johansen
2019-06-28 14:45 ` Stephen Smalley
2019-06-28 16:15 ` Casey Schaufler
2019-06-28 18:08 ` John Johansen
[not found] ` <CAB9W1A1nwE7WBZqTe-GV8xNb83_B2ybV7cco++nfMjtDz9NJrg@mail.gmail.com>
2019-06-29 1:01 ` Fwd: " Stephen Smalley
2019-06-29 19:45 ` Casey Schaufler
2019-07-02 0:49 ` James Morris
2019-07-02 1:20 ` Casey Schaufler
2019-06-26 19:22 ` [PATCH v4 16/23] LSM: Use lsmcontext in security_secid_to_secctx Casey Schaufler
2019-06-26 23:14 ` Kees Cook
2019-06-27 21:34 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 17/23] " Casey Schaufler
2019-06-26 23:15 ` Kees Cook
2019-06-27 3:53 ` Kees Cook
2019-06-27 16:29 ` Casey Schaufler
2019-06-27 17:17 ` Kees Cook
2019-06-27 17:36 ` Casey Schaufler
2019-06-27 21:34 ` John Johansen
2019-06-27 21:36 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 18/23] LSM: Use lsmcontext in security_dentry_init_security Casey Schaufler
2019-06-26 23:15 ` Kees Cook
2019-06-27 21:34 ` John Johansen
2019-06-28 10:07 ` Ondrej Mosnacek
2019-06-26 19:22 ` [PATCH v4 19/23] LSM: Use lsmcontext in security_inode_getsecctx Casey Schaufler
2019-06-26 23:16 ` Kees Cook
2019-06-27 21:36 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 20/23] LSM: security_secid_to_secctx in netlink netfilter Casey Schaufler
2019-06-26 23:16 ` Kees Cook
2019-06-27 21:37 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 21/23] Audit: Store LSM audit information in an lsmblob Casey Schaufler
2019-06-26 23:16 ` Kees Cook
2019-06-27 21:37 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 22/23] NET: Store LSM netlabel data in a lsmblob Casey Schaufler
2019-06-26 23:18 ` Kees Cook
2019-06-27 21:38 ` John Johansen
2019-06-26 19:22 ` [PATCH v4 23/23] AppArmor: Remove the exclusive flag Casey Schaufler
2019-06-26 23:18 ` Kees Cook
2019-06-27 2:22 ` James Morris
2019-06-27 3:28 ` Kees Cook
2019-06-27 3:44 ` John Johansen [this message]
2019-06-27 3:49 ` James Morris
2019-06-27 21:38 ` John Johansen
2019-06-26 21:04 ` [PATCH v4 00/23] LSM: Module stacking for AppArmor Kees Cook
2019-06-26 21:11 ` John Johansen
2019-06-26 23:04 ` Kees Cook
2019-06-26 21:25 ` Casey Schaufler
2019-06-27 2:41 ` James Morris
2019-06-27 2:46 ` James Morris
2019-06-27 3:45 ` James Morris
2019-06-27 4:10 ` James Morris
2019-06-27 17:07 ` Kees Cook
2019-06-27 18:10 ` James Morris
2019-06-27 3:51 ` Kees Cook
2019-06-27 21:52 ` John Johansen
2019-06-27 22:33 ` Casey Schaufler
2019-06-27 23:16 ` James Morris
2019-06-27 23:44 ` John Johansen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d89fbbe9-49cb-646e-6cba-7951cf835bf9@canonical.com \
--to=john.johansen@canonical.com \
--cc=casey.schaufler@intel.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).