Re: [PATCH v10] LSM: Multiple concurrent LSMs

[Eric Paris <eparis@redhat.com>]

On Wed, 2012-12-12 at 08:24 -0800, Casey Schaufler wrote:
> On 12/12/2012 7:55 AM, Eric Paris wrote:
> > On Wed, 2012-12-12 at 07:48 -0800, Casey Schaufler wrote:
> >
> > How about asking every LSM to implement a new 'enable' function.  If the
> > LSM is not 'present' only the new 'enable' function can be used.  If the
> > LSM is present either the legacy enable function every LSM uses today or
> > the new enable function can be used.  Thus even if you build the kernel
> > with stacking, you cannot enable a non-present LSM unless the tools have
> > been updated.
> 
> I'm sorry, but I am having trouble understanding what you're suggesting.

I'm believing every LSM has some mechanism by which it is 'enabled' at
run time.  With SELinux that mechanism is loading policy.  If you don't
load policy SELinux will not enforce anything.  I'm assuming something
similar exists for others.  Tell me if I'm wrong.

We know that legacy tools will break on an LSM if it is not
CONFIG_SECURITY_PRESET (or equivalent 'first in list').  I'm calling
this first LSM the 'present' LSM.

Legacy tools also will attempt to enable their LSM using the current
enabling interface.  For SELinux this is /sys/fs/selinux/load

Thus if as part of stacking we implement a new enabling interface for
each LSM and disable the legacy enabling mechanism when the LSM is not
present we make sure that new kernels can't get into the half and half
situation with old userspace.

Legacy 'enable' interface is /sys/fs/selinux/load
New enabling interface could be /sys/fs/selinux/new_load

In SELinux present mode, they would do the exact same thing.  In SELinux
non-present mode we could disable /sys/fs/selinux/load and only allow
new_load.  Thus old userspace cannot 'enable' SELinux on a new kernel
when it won't work.

Make any more sense?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.