From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751437AbcFXT42 (ORCPT ); Fri, 24 Jun 2016 15:56:28 -0400 Received: from nm46-vm9.bullet.mail.bf1.yahoo.com ([216.109.114.202]:57938 "EHLO nm46-vm9.bullet.mail.bf1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751002AbcFXT41 (ORCPT ); Fri, 24 Jun 2016 15:56:27 -0400 X-Yahoo-Newman-Id: 882540.91998.bm@smtp108.mail.bf1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: IouZHZoVM1lAlRFpFa48rgVrXZzXpgL3TH9BncwtRAHeY8A vadMZaiFLTffw9Mf2WkTKqP2EyBnqWYMNxBrP2aXrl1YIldFJZYfn_0quFsA TAtAenbmbsx9NbCBaf.pAhvt72ULSYMUdeqe_HNZ74bN6eH43dVFZIaxamtF dCPommxpOqKeb3XPHGYPj9URdUhN1sx7TELEsqkbKsxTKZmK.cTk7Tj0.Frh yjhX4o5j5dAiEtMoDMsU_7..QRzhz.Fcbb5.jz8lI94KtTd1X4ldzrSbleUy tOKU9NaRkaI1vAch3K59a0zjJTQx9RPVmOywTqWiscFQnGaCc9Yf_NG229h9 5eV.HkGV_4m3Hy.5EZ6U9MrAdRv_J3F2XR.5L0a67JzKSussslD9dXt3KIeg 5_T8tE_zHnGWAD7s07CGAFiU9LEfKfXdANuQxxTrRd7PYXTsawwE7urKE5OY w29yFp9__Jbo9BGL.aI1LrkTpsQ6zRaZSLiKOfii09vrrud1_Hep81DE5zWO I7V8Ne3nzDPnW9zqQfA9SwOOXJ4RHv08Z0TJyRopCeX5ICKTnTdz8T4jjA88 - X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- Subject: Re: [PATCH v4 3/3] LSM: Add context interface for proc attrs To: Paul Moore References: <599d0a80-0838-2baa-8ee2-7eefafc10cec@schaufler-ca.com> <5767eed4-78ec-cc4c-2ece-c1fec4d752af@schaufler-ca.com> Cc: LSM , James Morris , John Johansen , Stephen Smalley , Tetsuo Handa , Kees Cook , LKLM From: Casey Schaufler Message-ID: <2997f1cb-bc7e-3517-28b5-171f83888ba1@schaufler-ca.com> Date: Fri, 24 Jun 2016 12:56:26 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 6/24/2016 12:15 PM, Paul Moore wrote: > On Thu, Jun 23, 2016 at 5:11 PM, Casey Schaufler wrote: >> Subject: [PATCH v4 3/3] LSM: Add context interface for proc attrs >> >> The /proc/.../attr/current interface is used by all three >> Linux security modules (SELinux, Smack and AppArmor) to >> report and modify the process security attribute. This is >> all fine when there is exactly one of these modules active >> and the userspace code knows which it module it is. >> It would require a major change to the "current" interface >> to provide information about more than one set of process >> security attributes. Instead, a "context" attribute is >> added, which identifies the security module that the >> information applies to. The format is: >> >> lsmname='context-value' >> >> When multiple concurrent modules are supported the >> /proc/.../attr/context interface will include the data >> for all of the active modules. >> >> lsmname1='context-value1'lsmname2='context-value2' >> >> The module specific subdirectories under attr contain context >> entries that report the information for that specific module >> in the same format. > I think a delimiter between the different LSMs would be a good idea. > A comma seems like a safe choice at the moment. It's unnecessary and makes for more complicated code in both directions, but everyone seems wedded to a delimiter. I'll propose a v5 with a delimiter. >