From: Greg KH <gregkh@linuxfoundation.org>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: casey.schaufler@intel.com, paul@paul-moore.com,
linux-security-module@vger.kernel.org, jmorris@namei.org,
keescook@chromium.org, john.johansen@canonical.com,
penguin-kernel@i-love.sakura.ne.jp,
stephen.smalley.work@gmail.com, linux-kernel@vger.kernel.org,
linux-api@vger.kernel.org, mic@digikod.net
Subject: Re: [PATCH v1 2/8] LSM: Add an LSM identifier for external use
Date: Wed, 26 Oct 2022 07:58:17 +0200 [thread overview]
Message-ID: <Y1jMeWl0oV4/2zyE@kroah.com> (raw)
In-Reply-To: <20221025184519.13231-3-casey@schaufler-ca.com>
On Tue, Oct 25, 2022 at 11:45:13AM -0700, Casey Schaufler wrote:
> Add an integer member "id" to the struct lsm_id. This value is
> a unique identifier associated with each security module. The
> values are defined in a new UAPI header file. Each existing LSM
> has been updated to include it's LSMID in the lsm_id.
>
> The LSM ID values are sequential, with the oldest module
> LSM_ID_CAPABILITY being the lowest value and the existing
> modules numbered in the order they were included in the
> main line kernel. The first 32 values (0 - 31) are reserved
> for some as yet unknown but important use.
>
> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
> ---
> include/linux/lsm_hooks.h | 1 +
> include/uapi/linux/lsm.h | 32 ++++++++++++++++++++++++++++++++
> security/apparmor/lsm.c | 2 ++
> security/bpf/hooks.c | 2 ++
> security/commoncap.c | 2 ++
> security/landlock/setup.c | 2 ++
> security/loadpin/loadpin.c | 2 ++
> security/lockdown/lockdown.c | 2 ++
> security/safesetid/lsm.c | 2 ++
> security/selinux/hooks.c | 2 ++
> security/smack/smack_lsm.c | 2 ++
> security/tomoyo/tomoyo.c | 2 ++
> security/yama/yama_lsm.c | 2 ++
> 13 files changed, 55 insertions(+)
> create mode 100644 include/uapi/linux/lsm.h
>
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index e383e468f742..dd4b4d95a172 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -1607,6 +1607,7 @@ struct security_hook_heads {
> */
> struct lsm_id {
> const char *lsm; /* Name of the LSM */
> + int id; /* LSM ID */
Again, kerneldoc.
And if this crosses the user/kernel boundry, please make it __u64. Or
__s32? Something explicit please.
> };
>
> /*
> diff --git a/include/uapi/linux/lsm.h b/include/uapi/linux/lsm.h
> new file mode 100644
> index 000000000000..d5bcbb9375df
> --- /dev/null
> +++ b/include/uapi/linux/lsm.h
> @@ -0,0 +1,32 @@
> +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
> +/*
> + * Linus Security Modules (LSM) - User space API
s/Linus/Linux/.
> + *
> + * Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com>
> + * Copyright (C) Intel Corporation
No date for Intel?
> + */
> +
> +#ifndef _UAPI_LINUX_LSM_H
> +#define _UAPI_LINUX_LSM_H
> +
> +/*
> + * ID values to identify security modules.
> + * A system may use more than one security module.
> + *
> + * LSM_ID_XXX values 0 - 31 are reserved for future use
Reserved for what? Why?
thanks,
greg k-h
next prev parent reply other threads:[~2022-10-26 5:57 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20221025184519.13231-1-casey.ref@schaufler-ca.com>
2022-10-25 18:45 ` [PATCH v1 0/8] LSM: Two basic syscalls Casey Schaufler
2022-10-25 18:45 ` [PATCH v1 1/8] LSM: Identify modules by more than name Casey Schaufler
2022-10-26 5:56 ` Greg KH
2022-10-25 18:45 ` [PATCH v1 2/8] LSM: Add an LSM identifier for external use Casey Schaufler
2022-10-26 5:58 ` Greg KH [this message]
2022-10-26 19:36 ` Casey Schaufler
2022-10-27 0:11 ` Tetsuo Handa
2022-10-27 6:31 ` Greg KH
2022-10-28 16:54 ` Casey Schaufler
2022-11-09 23:33 ` Paul Moore
2022-11-10 0:57 ` Casey Schaufler
2022-11-10 2:37 ` Paul Moore
2022-11-09 23:33 ` Paul Moore
2022-11-10 0:46 ` Casey Schaufler
2022-10-25 18:45 ` [PATCH v1 3/8] LSM: Identify the process attributes for each module Casey Schaufler
2022-10-26 5:59 ` Greg KH
2022-11-09 23:34 ` Paul Moore
2022-11-10 1:03 ` Casey Schaufler
2022-11-10 2:39 ` Paul Moore
2022-10-25 18:45 ` [PATCH v1 4/8] LSM: Maintain a table of LSM attribute data Casey Schaufler
2022-10-26 6:00 ` Greg KH
2022-10-27 0:38 ` Casey Schaufler
2022-10-27 6:29 ` Greg KH
2022-10-27 17:08 ` Casey Schaufler
2022-10-27 17:13 ` Greg KH
2022-11-09 23:34 ` Paul Moore
2022-11-09 23:34 ` Paul Moore
2022-10-25 18:45 ` [PATCH v1 5/8] proc: Use lsmids instead of lsm names for attrs Casey Schaufler
2022-10-25 18:45 ` [PATCH v1 6/8] LSM: lsm_self_attr syscall for LSM self attributes Casey Schaufler
2022-10-25 21:49 ` kernel test robot
2022-10-26 6:03 ` Greg KH
2022-10-26 7:01 ` kernel test robot
2022-10-26 8:14 ` kernel test robot
2022-10-26 9:33 ` kernel test robot
2022-11-09 23:34 ` Paul Moore
2022-11-10 1:32 ` Casey Schaufler
2022-11-10 3:02 ` Paul Moore
2022-11-10 23:36 ` Paul Moore
2022-11-11 0:36 ` Casey Schaufler
2022-11-11 3:16 ` Paul Moore
2022-10-25 18:45 ` [PATCH v1 7/8] LSM: Create lsm_module_list system call Casey Schaufler
2022-10-26 6:02 ` Greg KH
2022-10-26 12:07 ` kernel test robot
2022-11-09 23:35 ` Paul Moore
2022-11-10 1:37 ` Casey Schaufler
2022-11-10 3:17 ` Paul Moore
2022-10-25 18:45 ` [PATCH v1 8/8] lsm: wireup syscalls lsm_self_attr and lsm_module_list Casey Schaufler
2022-10-26 2:01 ` kernel test robot
2022-10-26 8:07 ` Geert Uytterhoeven
2022-11-23 19:57 [PATCH v1 0/8] LSM: Two basic syscalls Casey Schaufler
2022-11-23 19:57 ` [PATCH v1 2/8] LSM: Add an LSM identifier for external use Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y1jMeWl0oV4/2zyE@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=casey.schaufler@intel.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=keescook@chromium.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=stephen.smalley.work@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).