lkml.org 
[lkml]   [2015]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 0/7 v22] LSM: Multiple concurrent LSMs
From
Date
On Thu, 2015-05-07 at 13:36 -0700, Casey Schaufler wrote:
> On 5/7/2015 1:23 PM, Stephen Smalley wrote:
> > On 05/07/2015 04:22 PM, Mimi Zohar wrote:
> >> On Thu, 2015-05-07 at 14:07 -0400, Paul Moore wrote:
> >>> On Thu, May 7, 2015 at 10:47 AM, Casey Schaufler <casey@schaufler-ca.com> wrote:
> >>>> On 5/7/2015 4:37 AM, James Morris wrote:
> >>>>> On Sat, 2 May 2015, Casey Schaufler wrote:
> >>>>>
> >>>>>> Subject: [PATCH 0/7 v22] LSM: Multiple concurrent LSMs
> >>>>> Please add all of the Acked-by etc. from the patch review process.
> >>>> For v21 I had Acks from:
> >>>>
> >>>> John Johansen <john.johansen@canonical.com>
> >>>> Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> >>>> Stephen Smalley <sds@tycho.nsa.gov> (after patch 8/7)
> >>>> Kees Cook <keescook@chromium.org>
> >>>>
> >>>> Would you check out v22 and supply (or not) your Acks?
> >>>>
> >>>> Eric, Paul, it would be reassuring if you'd chime in as well.
> >>> Kubernetes has swallowed Eric whole I'm afraid, I don't think you want
> >>> to wait on him to review these patches.
> >>>
> >>> However, it is a bit ridiculous that I haven't had time to seriously
> >>> review these patches yet; I promise to take a look and send my
> >>> comments/ACKs before my head hits the pillow tonight.
> >> Seems to be working with SELinux, EVM and IMA enabled. I haven't tried
> >> enabling an additional LSM. Casey, do you have an additional LSM for
> >> testing?
> > I've tested SELinux+Yama.
>
> The deepest "stack" you can have today is Capability+Yama+YourChoice.
> You always get Capability, so you really only get to choose if you stack
> Yama with something else. That's not more depth than you had before, but
> the special case coding for Capability and Yama is replaced to the general
> scheme.

Nice cleanup! I assume this will pave the way for other small, builtin
LSMs. :)

I'm now running with Yama as well. While enabling Yama, I noticed a
very minor issue with security/Kconfig. It permits defining Yama as the
default LSM when it is stacked.

Mimi



\
 
 \ /
  Last update: 2015-05-08 13:41    [W:0.095 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site