From: Tony Jones <tonyj@suse.de>
To: serue@us.ibm.com
Cc: lkml <linux-kernel@vger.kernel.org>
Subject: Re: [patch 5/12] lsm stacking v0.2: actual stacker module
Date: Sun, 3 Jul 2005 20:18:20 -0700 [thread overview]
Message-ID: <20050704031820.GA6871@immunix.com> (raw)
In-Reply-To: <20050630195043.GE23538@serge.austin.ibm.com>
[-- Attachment #1: Type: text/plain, Size: 1107 bytes --]
Hey Serge,
I don't think your symbol_get() is doing what you think it is ;-)
> + * Add the stacked module (as specified by name and ops).
> + * If the module is not compiled in, the symbol_get at the end will
> + * prevent the the module from being unloaded.
> +*/
> +static int stacker_register (const char *name, struct security_operations *ops)
> +{
...
> + symbol_get(ops);
> +
> +out:
> + spin_unlock(&stacker_lock);
> + return ret;
> +}
Seemed useful to be able to view which modules had been unloaded.
Easier to maintain them on their own list than to compute the difference
of <stacked_modules> and <all_modules>. Patch attached, not sure if you
are cool with reusing the 'unload' file.
> +static struct stacker_attribute stacker_attr_unload = {
> + .attr = {.name = "unload", .mode = S_IFREG | S_IRUGO | S_IWUSR},
> + .store = stacker_unload_write,
> +};
Apart from this, looks good. I ran it against our regression tests using
AppArmor (SubDomain) composed with Capability and everything was functionally
as expected. I still need to run it through our SMP stress tests.
Thanks
Tony
[-- Attachment #2: stacker_v2.diff --]
[-- Type: text/plain, Size: 1579 bytes --]
--- stacker.c.orig 2005-07-03 19:57:21.000000000 -0700
+++ stacker.c 2005-07-03 19:55:40.000000000 -0700
@@ -39,6 +39,7 @@
struct security_operations module_operations;
};
static struct list_head stacked_modules; /* list of stacked modules */
+static struct list_head unloaded_modules; /* list of unloaded modules */
static struct list_head all_modules; /* list of all modules, including freed */
static short sysfsfiles_registered;
@@ -1439,6 +1440,7 @@
rcu_read_lock();
list_del_rcu(&m->lsm_list);
+ list_add_tail_rcu(&m->lsm_list, &unloaded_modules);
if (list_empty(&stacked_modules)) {
INIT_LIST_HEAD(&default_module.lsm_list);
list_add_tail_rcu(&default_module.lsm_list, &stacked_modules);
@@ -1452,9 +1454,26 @@
return ret;
}
+/* list unloaded modules */
+static ssize_t stacker_unload_read (struct stacker_kobj *obj, char *buff)
+{
+ ssize_t len = 0;
+ struct module_entry *m;
+
+ rcu_read_lock();
+ stack_for_each_entry(m, &unloaded_modules, lsm_list) {
+ len += snprintf(buff+len, PAGE_SIZE - len, "%s\n",
+ m->module_name);
+ }
+ rcu_read_unlock();
+
+ return len;
+}
+
static struct stacker_attribute stacker_attr_unload = {
.attr = {.name = "unload", .mode = S_IFREG | S_IRUGO | S_IWUSR},
.store = stacker_unload_write,
+ .show = stacker_unload_read,
};
@@ -1525,6 +1544,7 @@
INIT_LIST_HEAD(&stacked_modules);
INIT_LIST_HEAD(&all_modules);
+ INIT_LIST_HEAD(&unloaded_modules);
spin_lock_init(&stacker_lock);
default_module.module_name = DEFAULT_MODULE_NAME;
default_module.namelen = strlen(DEFAULT_MODULE_NAME);
next prev parent reply other threads:[~2005-07-04 3:22 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-06-30 19:44 [patch 0/12] lsm stacking v0.2: intro serue
2005-06-30 19:48 ` [patch 1/12] lsm stacking v0.2: don't default to dummy_##hook serue
2005-06-30 19:48 ` [patch 2/12] lsm stacking v0.2: replace void* security with hlist serue
2005-06-30 19:49 ` [patch 3/12] lsm stacking v0.2: introduce security_*_value API serue
2005-06-30 19:49 ` [patch 4/12] lsm stacking v0.2: stacker documentation serue
2005-06-30 19:50 ` [patch 5/12] lsm stacking v0.2: actual stacker module serue
2005-07-01 2:32 ` James Morris
2005-07-01 19:24 ` serge
2005-07-01 20:35 ` Greg KH
2005-07-03 0:24 ` serge
2005-07-03 18:25 ` Tony Jones
2005-07-03 18:53 ` James Morris
2005-07-03 19:09 ` Tony Jones
2005-07-03 20:44 ` [PATCH] securityfs Greg KH
2005-07-04 12:39 ` serge
2005-07-04 15:53 ` serge
2005-07-05 6:07 ` Greg KH
2005-07-06 12:25 ` serge
2005-07-06 6:52 ` James Morris
2005-07-06 7:04 ` Greg KH
2005-07-06 12:29 ` Stephen Smalley
2005-07-06 15:35 ` James Morris
2005-07-06 16:06 ` Stephen Smalley
2005-07-06 16:16 ` Greg KH
2005-07-06 18:01 ` Chris Wright
2005-07-06 22:08 ` serue
2005-07-06 22:22 ` Greg KH
2005-07-06 23:32 ` serge
2005-07-07 17:30 ` serge
2005-07-07 17:48 ` Greg KH
2005-07-07 18:27 ` serue
2005-07-07 22:46 ` serge
2005-07-07 23:06 ` Greg KH
2005-07-07 23:12 ` serue
2005-07-08 20:44 ` serue
2005-07-08 20:49 ` Greg KH
2005-07-08 21:03 ` Chris Wright
2005-07-04 3:18 ` Tony Jones [this message]
2005-07-04 11:51 ` [patch 5/12] lsm stacking v0.2: actual stacker module serge
2005-07-04 19:37 ` Tony Jones
2005-07-04 20:06 ` serge
2005-07-04 20:41 ` Tony Jones
2005-07-05 18:17 ` serge
2005-07-08 21:43 ` serue
2005-07-08 22:12 ` serue
2005-07-11 14:40 ` Stephen Smalley
2005-07-11 17:51 ` serue
2005-07-11 19:03 ` Stephen Smalley
2005-07-13 16:39 ` serue
2005-07-13 18:27 ` serue
2005-06-30 19:51 ` [patch 6/12] lsm stacking v0.2: stackable capability lsm serue
2005-06-30 19:52 ` [patch 7/12] lsm stacking v0.2: selinux: update security structs serue
2005-06-30 19:53 ` [patch 8/12] lsm stacking v0.2: selinux: use security_*_value API serue
2005-06-30 19:53 ` [patch 9/12] lsm stacking v0.2: selinux: remove secondary support serue
2005-06-30 19:54 ` [patch 10/12] lsm stacking v0.2: hook completeness verification serue
2005-06-30 19:55 ` [patch 11/12] lsm stacking v0.2: /proc/$$/attr/ sharing serue
2005-06-30 19:55 ` [patch 12/12] lsm stacking v0.2: update seclvl for stacking serue
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050704031820.GA6871@immunix.com \
--to=tonyj@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=serue@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).