From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Paul Moore <paul@paul-moore.com>,
Ondrej Mosnacek <omosnace@redhat.com>,
Mimi Zohar <zohar@linux.ibm.com>,
Casey Schaufler <casey@schaufler-ca.com>,
Tyler Hicks <tyhicks@linux.microsoft.com>,
tusharsu@linux.microsoft.com, Sasha Levin <sashal@kernel.org>,
James Morris <jmorris@namei.org>,
linux-integrity@vger.kernel.org,
SElinux list <selinux@vger.kernel.org>,
LSM List <linux-security-module@vger.kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] SELinux: Measure state and hash of policy using IMA
Date: Mon, 31 Aug 2020 09:39:08 -0700 [thread overview]
Message-ID: <612ec12d-0048-2a5f-83a5-518a11eb546d@linux.microsoft.com> (raw)
In-Reply-To: <CAEjxPJ6GkUot29g5qq2GVYzmY2xwfTvVJkNP2kK54OcW7tkz1Q@mail.gmail.com>
On 8/31/20 7:47 AM, Stephen Smalley wrote:
>>>>
>>>
>>> Could you please let me know when the current set of changes in SELinux
>>> next branch would be completed and be ready to take new changes?
>>>
>>> I mean, roughly - would it be a month from now or you expect that to
>>> take longer?
>>
>> I can't speak for Paul but I would expect it to be sooner rather than
>> later. Ondrej has some follow ups on top of my policy rcu conversion
>> but then it should be good to go.
>
> I think the major changes are now merged although there are still a
> couple of changes coming from Ondrej that could affect your code. For
> your purposes, the important things to note are:
>
> 1) The mutex has moved from selinux_fs_info to selinux_state and is
> now named policy_mutex. You will need to take it around your call to
> security_read_policy_kernel().
>
> 2) security_policydb_len() was removed and security_read_policy() just
> directly reads the policydb len. You can do the same from your
> security_read_policy_kernel() variant.
>
> 3) Ondrej has a pending change to move the policycap[] array from
> selinux_state to selinux_policy so that it can be atomically updated
> with the policy.
>
> 4) Ondrej has a pending change to eliminate the separate initialized
> boolean from selinux_state and just test whether selinux_state.policy
> is non-NULL but as long as you are using selinux_initialized() to
> test, your code should be unaffected.
>
Thanks a lot for the update Stephen.
I will start updating the IMA measurement changes in selinux next
branch. Will post the patches this week.
-lakshmi
next prev parent reply other threads:[~2020-08-31 16:39 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-22 1:00 [PATCH] SELinux: Measure state and hash of policy using IMA Lakshmi Ramasubramanian
2020-08-24 14:00 ` Stephen Smalley
2020-08-24 14:35 ` Lakshmi Ramasubramanian
2020-08-24 18:13 ` Lakshmi Ramasubramanian
2020-08-24 19:29 ` Stephen Smalley
2020-08-24 20:01 ` Ondrej Mosnacek
2020-08-24 21:29 ` Lakshmi Ramasubramanian
2020-08-24 22:18 ` Paul Moore
2020-08-25 20:49 ` Lakshmi Ramasubramanian
2020-08-26 12:51 ` Stephen Smalley
2020-08-31 14:47 ` Stephen Smalley
2020-08-31 16:39 ` Lakshmi Ramasubramanian [this message]
2020-09-07 21:38 Lakshmi Ramasubramanian
2020-09-07 22:32 ` Stephen Smalley
2020-09-08 4:44 ` Lakshmi Ramasubramanian
2020-09-08 11:58 ` Stephen Smalley
2020-09-08 16:01 ` Lakshmi Ramasubramanian
2020-09-08 12:28 ` Stephen Smalley
2020-09-08 12:35 ` Stephen Smalley
2020-09-08 13:03 ` Ondrej Mosnacek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=612ec12d-0048-2a5f-83a5-518a11eb546d@linux.microsoft.com \
--to=nramas@linux.microsoft.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=omosnace@redhat.com \
--cc=paul@paul-moore.com \
--cc=sashal@kernel.org \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
--cc=tusharsu@linux.microsoft.com \
--cc=tyhicks@linux.microsoft.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).