From: Paul Moore <paul@paul-moore.com>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [GIT PULL] LSM patches for v6.1
Date: Wed, 5 Oct 2022 09:38:27 -0400 [thread overview]
Message-ID: <CAHC9VhSK=oYxV=MzT7BLD3TuzQYiX0aY7h1aPb25wuRN=vPyKg@mail.gmail.com> (raw)
In-Reply-To: <87r0zmigx6.fsf@email.froward.int.ebiederm.org>
On Wed, Oct 5, 2022 at 8:39 AM Eric W. Biederman <ebiederm@xmission.com> wrote:
> Linus Torvalds <torvalds@linux-foundation.org> writes:
...
> > I'm not saying that an LSM is the only place to do it, but I don't
> > think there have been any better suggestions either.
>
> I don't know. I tried to have the conversation and Paul shut it down.
I would encourage anyone reading the above statement to look at the
previous discussion, links were provided at the top of this thread in
the original pull request.
> Effectively he said that where two or more out of tree LSM policies want
> something it makes no sense to discussion the actual reasons people want
> to use the hook.
Runtime kernel configuration is inherently "out of tree", this
includes not only loadable LSM security policies (e.g. a SELinux
policy), the system's firewall configuration, things like sysctl.conf,
and countless others. Please understand that "out of tree" in this
context is not the same as when it is used in the context of kernel
code; the former is actually a positive thing ("look we can configure
the kernel behavior the way we want!") while the latter is a
maintenance and support nightmare.
--
paul-moore.com
next prev parent reply other threads:[~2022-10-05 13:39 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-03 22:37 [GIT PULL] LSM patches for v6.1 Paul Moore
2022-10-04 1:03 ` pr-tracker-bot
2022-10-04 20:36 ` Eric W. Biederman
2022-10-04 20:55 ` Linus Torvalds
2022-10-04 21:30 ` Linus Torvalds
2022-10-05 12:59 ` Eric W. Biederman
2022-10-05 12:38 ` Eric W. Biederman
2022-10-05 13:38 ` Paul Moore [this message]
2022-10-05 15:32 ` Eric W. Biederman
2022-10-05 16:04 ` Paul Moore
2022-10-05 21:27 ` Eric W. Biederman
2022-10-05 22:39 ` Paul Moore
2022-10-05 18:54 ` Linus Torvalds
2022-10-06 12:52 ` Eric W. Biederman
2022-10-06 14:42 ` Theodore Ts'o
2022-10-06 8:29 ` Vegard Nossum
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhSK=oYxV=MzT7BLD3TuzQYiX0aY7h1aPb25wuRN=vPyKg@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).