Messages in this thread | | | Date | Fri, 31 Oct 2014 15:21:39 +0100 | From | Karol Lewandowski <> | Subject | Re: [PATCH 00/12] Add kdbus implementation |
| |
On 2014-10-31 00:39, Paul Moore wrote: > On Thursday, October 30, 2014 08:55:56 PM Karol Lewandowski wrote: >> On 2014-10-30 15:47, Greg Kroah-Hartman wrote: >>> Other than that, I don't know exactly what your patches do, or why they >>> are needed, care to go into details? >> >> Patches in question were supposed to add few hooks for kdbus-specific >> operations that doesn't seem to have compatible semantics with hooks >> currently available in LSM. >> >> kdbus' bus introduces quite a few new concepts that we wanted to be able >> to limit based on MAC label/context, eg. >> >> - check flags at HELO stage (say disallow fd passing), >> >> - restrict ability to acquire name to certain subjects (for system bus), >> >> - disallow creation of new buses, >> >> - limit scope of broadcasts, >> >> - etc. >> >> Please take a look at hook list - I think most of names are >> self-explanatory: >> >> >> https://github.com/lmctl/linux/blob/a9fe4c33b6e5ab25a243e0590df406aabb6add1 >> 2/include/linux/security.h#L1874 >> >> kdbus modifications were pretty light - with most visible change being >> addition of opaque security pointer to kdbus_bus and similar structs. > > [NOTE: we really should add the LSM list to this discussion and future > patchset postings.] > > Also, to be completely honest, I don't think we ever really arrived at any > final conclusion about those LSM/kdbus hooks either. At least I don't think I > ever really satisfied myself that what we had was the "right" solution.
Agreed, "hooks" are far from being complete. I think that patches were and still are - a starting point for discussion, not "a solution" itself.
Timing wasn't good either - since our last discussion (Apr/May 2014) kdbus policy engine has been completely rewritten and few core concepts changed too.
> We both got busy and kinda drifted away from this effort. Karol, did you do > any further work on the hooks?
I didn't. I was waiting for the peace of change in kdbus to slow down a bit and, honestly, wasn't expecting submission in few next months...
I'll do my best to post RFC patchset today or tomorrow.
Thanks -- Karol Lewandowski, Samsung R&D Institute Poland
| |