* [PATCH] LSM: Add /sys/kernel/security/lsm
@ 2017-01-17 23:42 Casey Schaufler
2017-01-18 0:25 ` John Johansen
` (2 more replies)
0 siblings, 3 replies; 10+ messages in thread
From: Casey Schaufler @ 2017-01-17 23:42 UTC (permalink / raw)
To: LSM, James Morris
Cc: John Johansen, Paul Moore, Kees Cook, Stephen Smalley,
Tetsuo Handa, LKLM
Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
I am still tired of having to find indirect ways to determine
what security modules are active on a system. I have added
/sys/kernel/security/lsm, which contains a comma separated
list of the active secuirty modules. No more groping around
in /proc/filesystems or other clever hacks.
Unchanged from previous versions except for being updated
to the latest security next branch.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
Documentation/security/LSM.txt | 7 +++++++
include/linux/lsm_hooks.h | 12 ++++--------
security/apparmor/lsm.c | 3 ++-
security/commoncap.c | 3 ++-
security/inode.c | 26 ++++++++++++++++++++++++--
security/loadpin/loadpin.c | 2 +-
security/security.c | 38 ++++++++++++++++++++++++++++++++++++++
security/selinux/hooks.c | 2 +-
security/smack/smack_lsm.c | 2 +-
security/tomoyo/tomoyo.c | 2 +-
security/yama/yama_lsm.c | 2 +-
11 files changed, 82 insertions(+), 17 deletions(-)
diff --git a/Documentation/security/LSM.txt b/Documentation/security/LSM.txt
index 3db7e67..c2683f2 100644
--- a/Documentation/security/LSM.txt
+++ b/Documentation/security/LSM.txt
@@ -22,6 +22,13 @@ system, building their checks on top of the defined capability hooks.
For more details on capabilities, see capabilities(7) in the Linux
man-pages project.
+A list of the active security modules can be found by reading
+/sys/kernel/security/lsm. This is a comma separated list, and
+will always include the capability module. The list reflects the
+order in which checks are made. The capability module will always
+be first, followed by any "minor" modules (e.g. Yama) and then
+the one "major" module (e.g. SELinux) if there is one configured.
+
Based on https://lkml.org/lkml/2007/10/26/215,
a new LSM is accepted into the kernel when its intent (a description of
what it tries to protect against and in what cases one would expect to
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 558adfa..132650d 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1876,6 +1876,7 @@ struct security_hook_list {
struct list_head list;
struct list_head *head;
union security_list_options hook;
+ char *lsm;
};
/*
@@ -1888,15 +1889,10 @@ struct security_hook_list {
{ .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } }
extern struct security_hook_heads security_hook_heads;
+extern char *lsm_names;
-static inline void security_add_hooks(struct security_hook_list *hooks,
- int count)
-{
- int i;
-
- for (i = 0; i < count; i++)
- list_add_tail_rcu(&hooks[i].list, hooks[i].head);
-}
+extern void security_add_hooks(struct security_hook_list *hooks, int count,
+ char *lsm);
#ifdef CONFIG_SECURITY_SELINUX_DISABLE
/*
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 41b8cb1..1d4843d 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -886,7 +886,8 @@ static int __init apparmor_init(void)
aa_free_root_ns();
goto alloc_out;
}
- security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks));
+ security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),
+ "apparmor");
/* Report that AppArmor successfully initialized */
apparmor_initialized = 1;
diff --git a/security/commoncap.c b/security/commoncap.c
index 8df676f..6d4d586 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -1093,7 +1093,8 @@ struct security_hook_list capability_hooks[] = {
void __init capability_add_hooks(void)
{
- security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks));
+ security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),
+ "capability");
}
#endif /* CONFIG_SECURITY */
diff --git a/security/inode.c b/security/inode.c
index c83db05..546e786 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -20,6 +20,7 @@
#include <linux/init.h>
#include <linux/namei.h>
#include <linux/security.h>
+#include <linux/lsm_hooks.h>
#include <linux/magic.h>
static struct vfsmount *mount;
@@ -204,6 +205,21 @@ void securityfs_remove(struct dentry *dentry)
}
EXPORT_SYMBOL_GPL(securityfs_remove);
+#ifdef CONFIG_SECURITY
+static struct dentry *lsm_dentry;
+static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count,
+ loff_t *ppos)
+{
+ return simple_read_from_buffer(buf, count, ppos, lsm_names,
+ strlen(lsm_names));
+}
+
+static const struct file_operations lsm_ops = {
+ .read = lsm_read,
+ .llseek = generic_file_llseek,
+};
+#endif
+
static int __init securityfs_init(void)
{
int retval;
@@ -213,9 +229,15 @@ static int __init securityfs_init(void)
return retval;
retval = register_filesystem(&fs_type);
- if (retval)
+ if (retval) {
sysfs_remove_mount_point(kernel_kobj, "security");
- return retval;
+ return retval;
+ }
+#ifdef CONFIG_SECURITY
+ lsm_dentry = securityfs_create_file("lsm", 0444, NULL, NULL,
+ &lsm_ops);
+#endif
+ return 0;
}
core_initcall(securityfs_init);
diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
index 89a46f1..1d82eae 100644
--- a/security/loadpin/loadpin.c
+++ b/security/loadpin/loadpin.c
@@ -182,7 +182,7 @@ static struct security_hook_list loadpin_hooks[] = {
void __init loadpin_add_hooks(void)
{
pr_info("ready to pin (currently %sabled)", enabled ? "en" : "dis");
- security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks));
+ security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
}
/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
diff --git a/security/security.c b/security/security.c
index f825304..f0a802ee 100644
--- a/security/security.c
+++ b/security/security.c
@@ -32,6 +32,7 @@
/* Maximum number of letters for an LSM name string */
#define SECURITY_NAME_MAX 10
+char *lsm_names;
/* Boot-time LSM user choice */
static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
CONFIG_DEFAULT_SECURITY;
@@ -78,6 +79,22 @@ static int __init choose_lsm(char *str)
}
__setup("security=", choose_lsm);
+static int lsm_append(char *new, char **result)
+{
+ char *cp;
+
+ if (*result == NULL) {
+ *result = kstrdup(new, GFP_KERNEL);
+ } else {
+ cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);
+ if (cp == NULL)
+ return -ENOMEM;
+ kfree(*result);
+ *result = cp;
+ }
+ return 0;
+}
+
/**
* security_module_enable - Load given security module on boot ?
* @module: the name of the module
@@ -97,6 +114,27 @@ int __init security_module_enable(const char *module)
return !strcmp(module, chosen_lsm);
}
+/**
+ * security_add_hooks - Add a modules hooks to the hook lists.
+ * @hooks: the hooks to add
+ * @count: the number of hooks to add
+ * @lsm: the name of the security module
+ *
+ * Each LSM has to register its hooks with the infrastructure.
+ */
+void __init security_add_hooks(struct security_hook_list *hooks, int count,
+ char *lsm)
+{
+ int i;
+
+ for (i = 0; i < count; i++) {
+ hooks[i].lsm = lsm;
+ list_add_tail_rcu(&hooks[i].list, hooks[i].head);
+ }
+ if (lsm_append(lsm, &lsm_names) < 0)
+ panic("%s - Cannot get early memory.\n", __func__);
+}
+
/*
* Hook list operation macros.
*
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index c7c6619..fdc24ea 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6349,7 +6349,7 @@ static __init int selinux_init(void)
0, SLAB_PANIC, NULL);
avc_init();
- security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
+ security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
panic("SELinux: Unable to register AVC netcache callback\n");
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 94dc9d4..839150e 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -4819,7 +4819,7 @@ static __init int smack_init(void)
/*
* Register with LSM
*/
- security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks));
+ security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack");
return 0;
}
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index 75c9987..edc52d6 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -542,7 +542,7 @@ static int __init tomoyo_init(void)
if (!security_module_enable("tomoyo"))
return 0;
/* register ourselves with the security framework */
- security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks));
+ security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo");
printk(KERN_INFO "TOMOYO Linux initialized\n");
cred->security = &tomoyo_kernel_domain;
tomoyo_mm_init();
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index 968e5e0..88271a3 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -485,6 +485,6 @@ static inline void yama_init_sysctl(void) { }
void __init yama_add_hooks(void)
{
pr_info("Yama: becoming mindful.\n");
- security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks));
+ security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), "yama");
yama_init_sysctl();
}
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-17 23:42 [PATCH] LSM: Add /sys/kernel/security/lsm Casey Schaufler
@ 2017-01-18 0:25 ` John Johansen
2017-01-18 12:43 ` James Morris
2017-01-18 23:29 ` James Morris
2 siblings, 0 replies; 10+ messages in thread
From: John Johansen @ 2017-01-18 0:25 UTC (permalink / raw)
To: Casey Schaufler, LSM, James Morris
Cc: Paul Moore, Kees Cook, Stephen Smalley, Tetsuo Handa, LKLM
On 01/17/2017 03:42 PM, Casey Schaufler wrote:
> Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
>
> I am still tired of having to find indirect ways to determine
> what security modules are active on a system. I have added
> /sys/kernel/security/lsm, which contains a comma separated
> list of the active secuirty modules. No more groping around
> in /proc/filesystems or other clever hacks.
>
> Unchanged from previous versions except for being updated
> to the latest security next branch.
>
If Tetsuo ever gets his way and gets module loading back in,
constructing the list in lsm_read instead of constructing it
using lsm_append at init would be beter, but that is an if and
can be done later if needed.
> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: John Johansen <john.johansen@canonical.com>
>
> ---
> Documentation/security/LSM.txt | 7 +++++++
> include/linux/lsm_hooks.h | 12 ++++--------
> security/apparmor/lsm.c | 3 ++-
> security/commoncap.c | 3 ++-
> security/inode.c | 26 ++++++++++++++++++++++++--
> security/loadpin/loadpin.c | 2 +-
> security/security.c | 38 ++++++++++++++++++++++++++++++++++++++
> security/selinux/hooks.c | 2 +-
> security/smack/smack_lsm.c | 2 +-
> security/tomoyo/tomoyo.c | 2 +-
> security/yama/yama_lsm.c | 2 +-
> 11 files changed, 82 insertions(+), 17 deletions(-)
>
> diff --git a/Documentation/security/LSM.txt b/Documentation/security/LSM.txt
> index 3db7e67..c2683f2 100644
> --- a/Documentation/security/LSM.txt
> +++ b/Documentation/security/LSM.txt
> @@ -22,6 +22,13 @@ system, building their checks on top of the defined capability hooks.
> For more details on capabilities, see capabilities(7) in the Linux
> man-pages project.
>
> +A list of the active security modules can be found by reading
> +/sys/kernel/security/lsm. This is a comma separated list, and
> +will always include the capability module. The list reflects the
> +order in which checks are made. The capability module will always
> +be first, followed by any "minor" modules (e.g. Yama) and then
> +the one "major" module (e.g. SELinux) if there is one configured.
> +
> Based on https://lkml.org/lkml/2007/10/26/215,
> a new LSM is accepted into the kernel when its intent (a description of
> what it tries to protect against and in what cases one would expect to
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index 558adfa..132650d 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -1876,6 +1876,7 @@ struct security_hook_list {
> struct list_head list;
> struct list_head *head;
> union security_list_options hook;
> + char *lsm;
> };
>
> /*
> @@ -1888,15 +1889,10 @@ struct security_hook_list {
> { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } }
>
> extern struct security_hook_heads security_hook_heads;
> +extern char *lsm_names;
>
> -static inline void security_add_hooks(struct security_hook_list *hooks,
> - int count)
> -{
> - int i;
> -
> - for (i = 0; i < count; i++)
> - list_add_tail_rcu(&hooks[i].list, hooks[i].head);
> -}
> +extern void security_add_hooks(struct security_hook_list *hooks, int count,
> + char *lsm);
>
> #ifdef CONFIG_SECURITY_SELINUX_DISABLE
> /*
> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index 41b8cb1..1d4843d 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -886,7 +886,8 @@ static int __init apparmor_init(void)
> aa_free_root_ns();
> goto alloc_out;
> }
> - security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks));
> + security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),
> + "apparmor");
>
> /* Report that AppArmor successfully initialized */
> apparmor_initialized = 1;
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 8df676f..6d4d586 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -1093,7 +1093,8 @@ struct security_hook_list capability_hooks[] = {
>
> void __init capability_add_hooks(void)
> {
> - security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks));
> + security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),
> + "capability");
> }
>
> #endif /* CONFIG_SECURITY */
> diff --git a/security/inode.c b/security/inode.c
> index c83db05..546e786 100644
> --- a/security/inode.c
> +++ b/security/inode.c
> @@ -20,6 +20,7 @@
> #include <linux/init.h>
> #include <linux/namei.h>
> #include <linux/security.h>
> +#include <linux/lsm_hooks.h>
> #include <linux/magic.h>
>
> static struct vfsmount *mount;
> @@ -204,6 +205,21 @@ void securityfs_remove(struct dentry *dentry)
> }
> EXPORT_SYMBOL_GPL(securityfs_remove);
>
> +#ifdef CONFIG_SECURITY
> +static struct dentry *lsm_dentry;
> +static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count,
> + loff_t *ppos)
> +{
> + return simple_read_from_buffer(buf, count, ppos, lsm_names,
> + strlen(lsm_names));
> +}
> +
> +static const struct file_operations lsm_ops = {
> + .read = lsm_read,
> + .llseek = generic_file_llseek,
> +};
> +#endif
> +
> static int __init securityfs_init(void)
> {
> int retval;
> @@ -213,9 +229,15 @@ static int __init securityfs_init(void)
> return retval;
>
> retval = register_filesystem(&fs_type);
> - if (retval)
> + if (retval) {
> sysfs_remove_mount_point(kernel_kobj, "security");
> - return retval;
> + return retval;
> + }
> +#ifdef CONFIG_SECURITY
> + lsm_dentry = securityfs_create_file("lsm", 0444, NULL, NULL,
> + &lsm_ops);
> +#endif
> + return 0;
> }
>
> core_initcall(securityfs_init);
> diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
> index 89a46f1..1d82eae 100644
> --- a/security/loadpin/loadpin.c
> +++ b/security/loadpin/loadpin.c
> @@ -182,7 +182,7 @@ static struct security_hook_list loadpin_hooks[] = {
> void __init loadpin_add_hooks(void)
> {
> pr_info("ready to pin (currently %sabled)", enabled ? "en" : "dis");
> - security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks));
> + security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
> }
>
> /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
> diff --git a/security/security.c b/security/security.c
> index f825304..f0a802ee 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -32,6 +32,7 @@
> /* Maximum number of letters for an LSM name string */
> #define SECURITY_NAME_MAX 10
>
> +char *lsm_names;
> /* Boot-time LSM user choice */
> static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
> CONFIG_DEFAULT_SECURITY;
> @@ -78,6 +79,22 @@ static int __init choose_lsm(char *str)
> }
> __setup("security=", choose_lsm);
>
> +static int lsm_append(char *new, char **result)
> +{
> + char *cp;
> +
> + if (*result == NULL) {
> + *result = kstrdup(new, GFP_KERNEL);
> + } else {
> + cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);
> + if (cp == NULL)
> + return -ENOMEM;
> + kfree(*result);
> + *result = cp;
> + }
> + return 0;
> +}
> +
> /**
> * security_module_enable - Load given security module on boot ?
> * @module: the name of the module
> @@ -97,6 +114,27 @@ int __init security_module_enable(const char *module)
> return !strcmp(module, chosen_lsm);
> }
>
> +/**
> + * security_add_hooks - Add a modules hooks to the hook lists.
> + * @hooks: the hooks to add
> + * @count: the number of hooks to add
> + * @lsm: the name of the security module
> + *
> + * Each LSM has to register its hooks with the infrastructure.
> + */
> +void __init security_add_hooks(struct security_hook_list *hooks, int count,
> + char *lsm)
> +{
> + int i;
> +
> + for (i = 0; i < count; i++) {
> + hooks[i].lsm = lsm;
> + list_add_tail_rcu(&hooks[i].list, hooks[i].head);
> + }
> + if (lsm_append(lsm, &lsm_names) < 0)
> + panic("%s - Cannot get early memory.\n", __func__);
> +}
> +
> /*
> * Hook list operation macros.
> *
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index c7c6619..fdc24ea 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -6349,7 +6349,7 @@ static __init int selinux_init(void)
> 0, SLAB_PANIC, NULL);
> avc_init();
>
> - security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
> + security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
>
> if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
> panic("SELinux: Unable to register AVC netcache callback\n");
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 94dc9d4..839150e 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -4819,7 +4819,7 @@ static __init int smack_init(void)
> /*
> * Register with LSM
> */
> - security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks));
> + security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack");
>
> return 0;
> }
> diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
> index 75c9987..edc52d6 100644
> --- a/security/tomoyo/tomoyo.c
> +++ b/security/tomoyo/tomoyo.c
> @@ -542,7 +542,7 @@ static int __init tomoyo_init(void)
> if (!security_module_enable("tomoyo"))
> return 0;
> /* register ourselves with the security framework */
> - security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks));
> + security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo");
> printk(KERN_INFO "TOMOYO Linux initialized\n");
> cred->security = &tomoyo_kernel_domain;
> tomoyo_mm_init();
> diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
> index 968e5e0..88271a3 100644
> --- a/security/yama/yama_lsm.c
> +++ b/security/yama/yama_lsm.c
> @@ -485,6 +485,6 @@ static inline void yama_init_sysctl(void) { }
> void __init yama_add_hooks(void)
> {
> pr_info("Yama: becoming mindful.\n");
> - security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks));
> + security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), "yama");
> yama_init_sysctl();
> }
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-17 23:42 [PATCH] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2017-01-18 0:25 ` John Johansen
@ 2017-01-18 12:43 ` James Morris
2017-01-18 14:30 ` Tetsuo Handa
2017-01-18 19:22 ` Paul Moore
2017-01-18 23:29 ` James Morris
2 siblings, 2 replies; 10+ messages in thread
From: James Morris @ 2017-01-18 12:43 UTC (permalink / raw)
To: Casey Schaufler
Cc: LSM, John Johansen, Paul Moore, Kees Cook, Stephen Smalley,
Tetsuo Handa, LKLM
On Tue, 17 Jan 2017, Casey Schaufler wrote:
> Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
>
> I am still tired of having to find indirect ways to determine
> what security modules are active on a system. I have added
> /sys/kernel/security/lsm, which contains a comma separated
> list of the active secuirty modules. No more groping around
> in /proc/filesystems or other clever hacks.
>
> Unchanged from previous versions except for being updated
> to the latest security next branch.
>
Any objections to merging this?
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-18 12:43 ` James Morris
@ 2017-01-18 14:30 ` Tetsuo Handa
2017-01-18 19:22 ` Paul Moore
1 sibling, 0 replies; 10+ messages in thread
From: Tetsuo Handa @ 2017-01-18 14:30 UTC (permalink / raw)
To: jmorris, casey
Cc: linux-security-module, john.johansen, paul, keescook, sds, linux-kernel
James Morris wrote:
> On Tue, 17 Jan 2017, Casey Schaufler wrote:
>
> > Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
> >
> > I am still tired of having to find indirect ways to determine
> > what security modules are active on a system. I have added
> > /sys/kernel/security/lsm, which contains a comma separated
> > list of the active secuirty modules. No more groping around
> > in /proc/filesystems or other clever hacks.
> >
> > Unchanged from previous versions except for being updated
> > to the latest security next branch.
> >
>
> Any objections to merging this?
No objection from me. Please go ahead.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-18 12:43 ` James Morris
2017-01-18 14:30 ` Tetsuo Handa
@ 2017-01-18 19:22 ` Paul Moore
2017-01-18 21:01 ` Kees Cook
1 sibling, 1 reply; 10+ messages in thread
From: Paul Moore @ 2017-01-18 19:22 UTC (permalink / raw)
To: James Morris, Casey Schaufler
Cc: LSM, John Johansen, Kees Cook, Stephen Smalley, Tetsuo Handa, LKLM
On Wed, Jan 18, 2017 at 7:43 AM, James Morris <jmorris@namei.org> wrote:
> On Tue, 17 Jan 2017, Casey Schaufler wrote:
>
>> Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
>>
>> I am still tired of having to find indirect ways to determine
>> what security modules are active on a system. I have added
>> /sys/kernel/security/lsm, which contains a comma separated
>> list of the active secuirty modules. No more groping around
>> in /proc/filesystems or other clever hacks.
>>
>> Unchanged from previous versions except for being updated
>> to the latest security next branch.
>>
>
> Any objections to merging this?
>
I'm fairly certain I ack'd a prior version of this at one point ...
Acked-by: Paul Moore <paul@paul-moore.com>
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-18 19:22 ` Paul Moore
@ 2017-01-18 21:01 ` Kees Cook
2017-01-18 23:00 ` James Morris
0 siblings, 1 reply; 10+ messages in thread
From: Kees Cook @ 2017-01-18 21:01 UTC (permalink / raw)
To: Paul Moore
Cc: James Morris, Casey Schaufler, LSM, John Johansen,
Stephen Smalley, Tetsuo Handa, LKLM
On Wed, Jan 18, 2017 at 11:22 AM, Paul Moore <paul@paul-moore.com> wrote:
> On Wed, Jan 18, 2017 at 7:43 AM, James Morris <jmorris@namei.org> wrote:
>> On Tue, 17 Jan 2017, Casey Schaufler wrote:
>>
>>> Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
>>>
>>> I am still tired of having to find indirect ways to determine
>>> what security modules are active on a system. I have added
>>> /sys/kernel/security/lsm, which contains a comma separated
>>> list of the active secuirty modules. No more groping around
>>> in /proc/filesystems or other clever hacks.
>>>
>>> Unchanged from previous versions except for being updated
>>> to the latest security next branch.
>>>
>>
>> Any objections to merging this?
>>
>
> I'm fairly certain I ack'd a prior version of this at one point ...
>
> Acked-by: Paul Moore <paul@paul-moore.com>
Yeah, me too.
Acked-by: Kees Cook <keescook@chromium.org>
-Kees
--
Kees Cook
Nexus Security
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-18 21:01 ` Kees Cook
@ 2017-01-18 23:00 ` James Morris
2017-01-18 23:25 ` Casey Schaufler
0 siblings, 1 reply; 10+ messages in thread
From: James Morris @ 2017-01-18 23:00 UTC (permalink / raw)
To: Kees Cook
Cc: Paul Moore, Casey Schaufler, LSM, John Johansen, Stephen Smalley,
Tetsuo Handa, LKLM
On Wed, 18 Jan 2017, Kees Cook wrote:
> On Wed, Jan 18, 2017 at 11:22 AM, Paul Moore <paul@paul-moore.com> wrote:
> > On Wed, Jan 18, 2017 at 7:43 AM, James Morris <jmorris@namei.org> wrote:
> >> On Tue, 17 Jan 2017, Casey Schaufler wrote:
> >>
> >>> Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
> >>>
> >>> I am still tired of having to find indirect ways to determine
> >>> what security modules are active on a system. I have added
> >>> /sys/kernel/security/lsm, which contains a comma separated
> >>> list of the active secuirty modules. No more groping around
> >>> in /proc/filesystems or other clever hacks.
> >>>
> >>> Unchanged from previous versions except for being updated
> >>> to the latest security next branch.
> >>>
> >>
> >> Any objections to merging this?
> >>
> >
> > I'm fairly certain I ack'd a prior version of this at one point ...
> >
> > Acked-by: Paul Moore <paul@paul-moore.com>
>
> Yeah, me too.
>
> Acked-by: Kees Cook <keescook@chromium.org>
>
Casey: next time, please remember to include previous acks.
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-18 23:00 ` James Morris
@ 2017-01-18 23:25 ` Casey Schaufler
0 siblings, 0 replies; 10+ messages in thread
From: Casey Schaufler @ 2017-01-18 23:25 UTC (permalink / raw)
To: James Morris, Kees Cook
Cc: Paul Moore, LSM, John Johansen, Stephen Smalley, Tetsuo Handa, LKLM
On 1/18/2017 3:00 PM, James Morris wrote:
> On Wed, 18 Jan 2017, Kees Cook wrote:
>
>> On Wed, Jan 18, 2017 at 11:22 AM, Paul Moore <paul@paul-moore.com> wrote:
>>> On Wed, Jan 18, 2017 at 7:43 AM, James Morris <jmorris@namei.org> wrote:
>>>> On Tue, 17 Jan 2017, Casey Schaufler wrote:
>>>>
>>>>> Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
>>>>>
>>>>> I am still tired of having to find indirect ways to determine
>>>>> what security modules are active on a system. I have added
>>>>> /sys/kernel/security/lsm, which contains a comma separated
>>>>> list of the active secuirty modules. No more groping around
>>>>> in /proc/filesystems or other clever hacks.
>>>>>
>>>>> Unchanged from previous versions except for being updated
>>>>> to the latest security next branch.
>>>>>
>>>> Any objections to merging this?
>>>>
>>> I'm fairly certain I ack'd a prior version of this at one point ...
>>>
>>> Acked-by: Paul Moore <paul@paul-moore.com>
>> Yeah, me too.
>>
>> Acked-by: Kees Cook <keescook@chromium.org>
>>
> Casey: next time, please remember to include previous acks.
Sorry. You had said you where taking it after 4.8, but didn't.
I assumed that I was starting over. My mistake.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-17 23:42 [PATCH] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2017-01-18 0:25 ` John Johansen
2017-01-18 12:43 ` James Morris
@ 2017-01-18 23:29 ` James Morris
2017-01-18 23:52 ` Casey Schaufler
2 siblings, 1 reply; 10+ messages in thread
From: James Morris @ 2017-01-18 23:29 UTC (permalink / raw)
To: Casey Schaufler
Cc: LSM, John Johansen, Paul Moore, Kees Cook, Stephen Smalley,
Tetsuo Handa, LKLM
On Tue, 17 Jan 2017, Casey Schaufler wrote:
> Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
>
> I am still tired of having to find indirect ways to determine
> what security modules are active on a system. I have added
> /sys/kernel/security/lsm, which contains a comma separated
> list of the active secuirty modules. No more groping around
> in /proc/filesystems or other clever hacks.
>
> Unchanged from previous versions except for being updated
> to the latest security next branch.
>
This doesn't apply cleanly to my tree.
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] LSM: Add /sys/kernel/security/lsm
2017-01-18 23:29 ` James Morris
@ 2017-01-18 23:52 ` Casey Schaufler
0 siblings, 0 replies; 10+ messages in thread
From: Casey Schaufler @ 2017-01-18 23:52 UTC (permalink / raw)
To: James Morris
Cc: LSM, John Johansen, Paul Moore, Kees Cook, Stephen Smalley,
Tetsuo Handa, LKLM, Casey Schaufler
On 1/18/2017 3:29 PM, James Morris wrote:
> On Tue, 17 Jan 2017, Casey Schaufler wrote:
>
>> Subject: [PATCH] LSM: Add /sys/kernel/security/lsm
>>
>> I am still tired of having to find indirect ways to determine
>> what security modules are active on a system. I have added
>> /sys/kernel/security/lsm, which contains a comma separated
>> list of the active secuirty modules. No more groping around
>> in /proc/filesystems or other clever hacks.
>>
>> Unchanged from previous versions except for being updated
>> to the latest security next branch.
>>
> This doesn't apply cleanly to my tree.
The AppArmor changes that you've added since you pulled
rc3 introduced some offset issues. Should I update my patch
to reflect them, or do you want to resolve the conflict?
I don't much care either way. Just let me know.
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2017-01-18 23:54 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-01-17 23:42 [PATCH] LSM: Add /sys/kernel/security/lsm Casey Schaufler
2017-01-18 0:25 ` John Johansen
2017-01-18 12:43 ` James Morris
2017-01-18 14:30 ` Tetsuo Handa
2017-01-18 19:22 ` Paul Moore
2017-01-18 21:01 ` Kees Cook
2017-01-18 23:00 ` James Morris
2017-01-18 23:25 ` Casey Schaufler
2017-01-18 23:29 ` James Morris
2017-01-18 23:52 ` Casey Schaufler
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).