| Message ID | ecb10f5c-7bbd-fb2e-4148-63290bc9a7ff@schaufler-ca.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | LSM: Module stacking for SARA and Landlock | expand |
On Mon, Nov 26, 2018 at 3:26 PM Casey Schaufler <casey@schaufler-ca.com> wrote: Hmmm... the "From: Kees..." in the body is missing. Are you using "git send-email"? > > This adds a flag for the current "major" LSMs to distinguish them when > we have a universal method for ordering all LSMs. It's called "legacy" > since the distinction of "major" will go away in the blob-sharing world. > > Signed-off-by: Kees Cook <keescook@chromium.org> > Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> > Reviewed-by: John Johansen <john.johansen@canonical.com> > --- > include/linux/lsm_hooks.h | 3 +++ > security/apparmor/lsm.c | 1 + > security/selinux/hooks.c | 1 + > security/smack/smack_lsm.c | 1 + > security/tomoyo/tomoyo.c | 1 + > 5 files changed, 7 insertions(+) > > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h > index aaeb7fa24dc4..63c0e102de20 100644 > --- a/include/linux/lsm_hooks.h > +++ b/include/linux/lsm_hooks.h > @@ -2039,8 +2039,11 @@ extern char *lsm_names; > extern void security_add_hooks(struct security_hook_list *hooks, int count, > char *lsm); > > +#define LSM_FLAG_LEGACY_MAJOR BIT(0) > + > struct lsm_info { > const char *name; /* Required. */ > + unsigned long flags; /* Optional: flags describing LSM */ > int (*init)(void); /* Required. */ > }; > > diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c > index 42446a216f3b..2edd35ca5044 100644 > --- a/security/apparmor/lsm.c > +++ b/security/apparmor/lsm.c > @@ -1728,5 +1728,6 @@ static int __init apparmor_init(void) > > DEFINE_LSM(apparmor) = { > .name = "apparmor", > + .flags = LSM_FLAG_LEGACY_MAJOR, > .init = apparmor_init, > }; > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 7ce683259357..56c6f1849c80 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -7209,6 +7209,7 @@ void selinux_complete_init(void) > all processes and objects when they are created. */ > DEFINE_LSM(selinux) = { > .name = "selinux", > + .flags = LSM_FLAG_LEGACY_MAJOR, > .init = selinux_init, > }; > > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index 81fb4c1631e9..3639e55b1f4b 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -4891,5 +4891,6 @@ static __init int smack_init(void) > */ > DEFINE_LSM(smack) = { > .name = "smack", > + .flags = LSM_FLAG_LEGACY_MAJOR, > .init = smack_init, > }; > diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c > index 1b5b5097efd7..09f7af130d3a 100644 > --- a/security/tomoyo/tomoyo.c > +++ b/security/tomoyo/tomoyo.c > @@ -552,5 +552,6 @@ static int __init tomoyo_init(void) > > DEFINE_LSM(tomoyo) = { > .name = "tomoyo", > + .flags = LSM_FLAG_LEGACY_MAJOR, > .init = tomoyo_init, > }; > -- > 2.14.5 > >
On Tue, Nov 27, 2018 at 2:27 PM Kees Cook <keescook@chromium.org> wrote: > On Mon, Nov 26, 2018 at 3:26 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > > Hmmm... the "From: Kees..." in the body is missing. Are you using "git > send-email"? Not to mention that you are sending (only) to the old SELinux mailing list. The new list is at selinux@vger.kernel.org, see: https://lore.kernel.org/selinux/8263f9fa-16f1-1d0a-e391-61d609e50d7d@tycho.nsa.gov/ > > > > > This adds a flag for the current "major" LSMs to distinguish them when > > we have a universal method for ordering all LSMs. It's called "legacy" > > since the distinction of "major" will go away in the blob-sharing world. > > > > Signed-off-by: Kees Cook <keescook@chromium.org> > > Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> > > Reviewed-by: John Johansen <john.johansen@canonical.com> > > --- > > include/linux/lsm_hooks.h | 3 +++ > > security/apparmor/lsm.c | 1 + > > security/selinux/hooks.c | 1 + > > security/smack/smack_lsm.c | 1 + > > security/tomoyo/tomoyo.c | 1 + > > 5 files changed, 7 insertions(+) > > > > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h > > index aaeb7fa24dc4..63c0e102de20 100644 > > --- a/include/linux/lsm_hooks.h > > +++ b/include/linux/lsm_hooks.h > > @@ -2039,8 +2039,11 @@ extern char *lsm_names; > > extern void security_add_hooks(struct security_hook_list *hooks, int count, > > char *lsm); > > > > +#define LSM_FLAG_LEGACY_MAJOR BIT(0) > > + > > struct lsm_info { > > const char *name; /* Required. */ > > + unsigned long flags; /* Optional: flags describing LSM */ > > int (*init)(void); /* Required. */ > > }; > > > > diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c > > index 42446a216f3b..2edd35ca5044 100644 > > --- a/security/apparmor/lsm.c > > +++ b/security/apparmor/lsm.c > > @@ -1728,5 +1728,6 @@ static int __init apparmor_init(void) > > > > DEFINE_LSM(apparmor) = { > > .name = "apparmor", > > + .flags = LSM_FLAG_LEGACY_MAJOR, > > .init = apparmor_init, > > }; > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > > index 7ce683259357..56c6f1849c80 100644 > > --- a/security/selinux/hooks.c > > +++ b/security/selinux/hooks.c > > @@ -7209,6 +7209,7 @@ void selinux_complete_init(void) > > all processes and objects when they are created. */ > > DEFINE_LSM(selinux) = { > > .name = "selinux", > > + .flags = LSM_FLAG_LEGACY_MAJOR, > > .init = selinux_init, > > }; > > > > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > > index 81fb4c1631e9..3639e55b1f4b 100644 > > --- a/security/smack/smack_lsm.c > > +++ b/security/smack/smack_lsm.c > > @@ -4891,5 +4891,6 @@ static __init int smack_init(void) > > */ > > DEFINE_LSM(smack) = { > > .name = "smack", > > + .flags = LSM_FLAG_LEGACY_MAJOR, > > .init = smack_init, > > }; > > diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c > > index 1b5b5097efd7..09f7af130d3a 100644 > > --- a/security/tomoyo/tomoyo.c > > +++ b/security/tomoyo/tomoyo.c > > @@ -552,5 +552,6 @@ static int __init tomoyo_init(void) > > > > DEFINE_LSM(tomoyo) = { > > .name = "tomoyo", > > + .flags = LSM_FLAG_LEGACY_MAJOR, > > .init = tomoyo_init, > > }; > > -- > > 2.14.5 > > > > > > > -- > Kees Cook > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
On 11/26/2018 9:34 PM, Kees Cook wrote: > On Mon, Nov 26, 2018 at 3:26 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > > Hmmm... the "From: Kees..." in the body is missing. Are you using "git > send-email"? Not for this posting. I will use it henceforth. I had some email configuration issues to work through.
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index aaeb7fa24dc4..63c0e102de20 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2039,8 +2039,11 @@ extern char *lsm_names; extern void security_add_hooks(struct security_hook_list *hooks, int count, char *lsm); +#define LSM_FLAG_LEGACY_MAJOR BIT(0) + struct lsm_info { const char *name; /* Required. */ + unsigned long flags; /* Optional: flags describing LSM */ int (*init)(void); /* Required. */ }; diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 42446a216f3b..2edd35ca5044 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1728,5 +1728,6 @@ static int __init apparmor_init(void) DEFINE_LSM(apparmor) = { .name = "apparmor", + .flags = LSM_FLAG_LEGACY_MAJOR, .init = apparmor_init, }; diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 7ce683259357..56c6f1849c80 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -7209,6 +7209,7 @@ void selinux_complete_init(void) all processes and objects when they are created. */ DEFINE_LSM(selinux) = { .name = "selinux", + .flags = LSM_FLAG_LEGACY_MAJOR, .init = selinux_init, }; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 81fb4c1631e9..3639e55b1f4b 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4891,5 +4891,6 @@ static __init int smack_init(void) */ DEFINE_LSM(smack) = { .name = "smack", + .flags = LSM_FLAG_LEGACY_MAJOR, .init = smack_init, }; diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c index 1b5b5097efd7..09f7af130d3a 100644 --- a/security/tomoyo/tomoyo.c +++ b/security/tomoyo/tomoyo.c @@ -552,5 +552,6 @@ static int __init tomoyo_init(void) DEFINE_LSM(tomoyo) = { .name = "tomoyo", + .flags = LSM_FLAG_LEGACY_MAJOR, .init = tomoyo_init, };