From: Casey Schaufler <casey@schaufler-ca.com>
To: Paul Moore <paul@paul-moore.com>, Kees Cook <keescook@chromium.org>
Cc: LSM <linux-security-module@vger.kernel.org>,
James Morris <jmorris@namei.org>,
John Johansen <john.johansen@canonical.com>,
Stephen Smalley <sds@tycho.nsa.gov>,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
LKLM <linux-kernel@vger.kernel.org>
Subject: [PATCH v5 0/3] LSM: security module information improvements
Date: Fri, 24 Jun 2016 16:26:17 -0700 [thread overview]
Message-ID: <587c9d63-bd39-5781-a7b6-6add2f63c72e@schaufler-ca.com> (raw)
In-Reply-To: <CAHC9VhR2EziX0iDk+xRa8PyRwrOOcgsE3jzbaQzb1Z3tviRLKg@mail.gmail.com>
Subject: [PATCH v5 0/3] LSM: security module information improvements
Changes from v4:
Use kasprintf instead of kzalloc() ... sprintf in more places.
More in the documentation.
Separate module information in contexts with ",". (not yet visible)
Changes from v3:
Use kasprintf instead of kzalloc() ... sprintf.
Create interfaces that make it possible to deal with process
attributes in the face of multiple "major" security modules.
Patch 1/3 adds /sys/kernel/security/lsm, which provides
a list of the active security modules on the system.
$ cat /sys/kernel/security/lsm
capability,yama,loadpin,smack
Patch 2/3 adds a subdirectory in /proc/.../attr for each
security module that exports process attribute data. This
allows a program in easily differentiate between the "current"
value for Smack and AppArmor.
$ cat /proc/self/attr/smack/current
System
$ cat /proc/self/attr/apparmor/current
unconfined
Patch 3/3 adds an interface that provides module identified
information that otherwise matches the "current" attr.
This allows a system with multiple modules to provide the
complete security "context" in one place. A (future) system
with both Smack and AppArmor might report:
$ cat /proc/self/attr/context
smack='System',apparmor='unconfined'
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
Documentation/security/LSM.txt | 34 ++++++--
fs/proc/base.c | 95 +++++++++++++++++++---
fs/proc/internal.h | 1 +
include/linux/lsm_hooks.h | 12 +--
include/linux/security.h | 15 ++--
security/apparmor/lsm.c | 38 +++++++--
security/commoncap.c | 3 +-
security/inode.c | 26 +++++-
security/loadpin/loadpin.c | 2 +-
security/security.c | 177 ++++++++++++++++++++++++++++++++++++++++-
security/selinux/hooks.c | 22 ++++-
security/smack/smack_lsm.c | 22 ++---
security/tomoyo/tomoyo.c | 2 +-
security/yama/yama_lsm.c | 2 +-
14 files changed, 395 insertions(+), 56 deletions(-)
next prev parent reply other threads:[~2016-06-24 23:26 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-23 21:07 [PATCH v4 0/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-23 21:10 ` [PATCH v4 1/3] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2016-06-24 18:56 ` Paul Moore
2016-06-23 21:11 ` [PATCH v4 2/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-24 19:11 ` Paul Moore
2016-06-24 20:05 ` Casey Schaufler
2016-06-24 20:08 ` Kees Cook
2016-06-24 20:29 ` Paul Moore
2016-06-24 23:26 ` Casey Schaufler [this message]
2016-06-24 23:27 ` [PATCH v5 1/3] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2016-06-29 17:01 ` Paul Moore
2016-07-02 17:21 ` John Johansen
2016-06-24 23:29 ` [PATCH v5 2/3] LSM: module hierarchy in /proc/.../attr Casey Schaufler
2016-06-29 17:03 ` Paul Moore
2016-07-02 17:24 ` John Johansen
2016-06-24 23:29 ` [PATCH v4 3/3] LSM: Add context interface for proc attrs Casey Schaufler
2016-06-24 23:38 ` [PATCH v5 " Casey Schaufler
2016-06-29 17:04 ` [PATCH v4 " Paul Moore
2016-07-02 17:25 ` John Johansen
2016-07-05 15:52 ` [PATCH v5 0/3] LSM: security module information improvements - Acked Casey Schaufler
2016-07-08 10:05 ` James Morris
2016-07-08 15:31 ` Casey Schaufler
2016-07-05 15:52 ` [PATCH v5 1/3] LSM: Add /sys/kernel/security/lsm " Casey Schaufler
2016-07-05 15:52 ` [PATCH v5 2/3] LSM: module hierarchy in /proc/.../attr " Casey Schaufler
2016-07-05 15:52 ` [PATCH v5 3/3] LSM: Add context interface for proc attrs " Casey Schaufler
2016-06-23 21:11 ` [PATCH v4 3/3] LSM: Add context interface for proc attrs Casey Schaufler
2016-06-23 21:49 ` Kees Cook
2016-06-23 22:10 ` Casey Schaufler
2016-06-24 16:38 ` [PATCH v4 4/3] LSM: Improve " Casey Schaufler
2016-06-24 17:48 ` Kees Cook
2016-06-24 19:15 ` [PATCH v4 3/3] LSM: Add " Paul Moore
2016-06-24 19:56 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=587c9d63-bd39-5781-a7b6-6add2f63c72e@schaufler-ca.com \
--to=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).