Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: Serge E. Hallyn <serue <at> us.ibm.com>
Subject: Re: A basic question about the security_* hooks
Newsgroups: gmane.linux.kernel.lsm
Date: Friday 25th December 2009 00:14:22 UTC (over 7 years ago)
Quoting Michael Stone (michael@laptop.org):
> Dear kernel folks,
> 
> There are a variety of places where I'd like to be able to get the kernel
to
> return EPERM more often [1]. Many of these places already have security
hooks.
> 
> Unfortunately, I don't feel that I can make effective use of these hooks
> because they seem to be "occupied" by the large mandatory access control
> frameworks.
> 
> I'm hoping that you can tell me why this state of affairs persists.
> 
> More specifically, now that LSMs are statically linked, why is it good
for the
> security hooks to call into a single monolithic "security_ops" struct
instead
> of cheaper and simpler alternatives?
> 
> In particular, what would be worse about a kernel in which each security
hook
> contained nothing but conditionally-compiled function calls to the
appropriate
> "real" implementation functions with early-exit jumps on non-zero return
codes?

The problem is that composing any two security policies can quickly have
subtle, unforeseen, but dangerous effects.  That's why so far we have
stuck with the status quo where only one LSM is 'active', but that LSM
can manually call hooks from other LSMs.

So with your module, I'd recommend following the route of the capabilities
LSM.  You can provide an optional stand-alone LSM which only hooks your
functions.  Then smack, for instance, can call the functions in your LSM
from within its own hooks, or it can simply explicitly assign its hooks to
your functions in smack_ops.  Selinux can do the same thing, although I
suspect they would more likely implement their own functions for your newly
hooked sites.

A distro can then compile a kernel with all LSMs compiled in, and switch
behavior by using "security=selinux" vs. "security=prctl_network_lsm"

-serge
--
To unsubscribe from this list: send the line "unsubscribe
linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
 
CD: 3ms