diff for duplicates of <1526014826.3414.46.camel@linux.vnet.ibm.com> diff --git a/a/1.txt b/N1/1.txt index bfaca6a..edb1c5f 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -3,7 +3,7 @@ On Thu, 2018-05-10 at 23:26 +0000, Luis R. Rodriguez wrote: > > On Wed, 2018-05-09 at 23:48 +0000, Luis R. Rodriguez wrote: > > > On Wed, May 09, 2018 at 06:06:57PM -0400, Mimi Zohar wrote: > > -> > > > > > Yes, writing regdb as a micro/mini LSM sounds reasonable. The LSM +> > > > > > Yes, writing regdb as a micro/mini LSM sounds reasonable. ?The LSM > > > > > > would differentiate between other firmware and the regulatory.db based > > > > > > on the firmware's pathname. > > > > > @@ -12,7 +12,7 @@ On Thu, 2018-05-10 at 23:26 +0000, Luis R. Rodriguez wrote: > > > > > regulatory db also doesn't make much sense. > > > > > > > > All calls to request_firmware() are already going through this LSM -> > > > hook. I should have said, it would be based on both READING_FIRMWARE +> > > > hook. ?I should have said, it would be based on both READING_FIRMWARE > > > > and the firmware's pathname. > > > > > > Yes, but it would still be a strcmp() computation added for all @@ -25,13 +25,18 @@ On Thu, 2018-05-10 at 23:26 +0000, Luis R. Rodriguez wrote: > Sorry but I must have missed this, can you send me the email or URL where he did that? > I never got a copy of that email I think. -My mistake. I've posted similar patches for kexec_load and for the +My mistake. ?I've posted similar patches for kexec_load and for the firmware sysfs fallback, both call security_kernel_read_file(). Casey's comment was in regards to kexec_load[1], not for the sysfs -fallback mode. Here's the link to the most recent version of the +fallback mode. ?Here's the link to the most recent version of the kexec_load patches.[2] -[1] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006690.html +[1]?http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006690.html [2] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006854.html Mimi + +-- +To unsubscribe from this list: send the line "unsubscribe linux-security-module" in +the body of a message to majordomo at vger.kernel.org +More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/a/content_digest b/N1/content_digest index 771064e..3e7098a 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -9,30 +9,10 @@ "ref\020180509234814.GY27853@wotan.suse.de\0" "ref\01525917658.3551.322.camel@linux.vnet.ibm.com\0" "ref\020180510232639.GF27853@wotan.suse.de\0" - "From\0Mimi Zohar <zohar@linux.vnet.ibm.com>\0" - "Subject\0Re: [PATCH 3/6] firmware: differentiate between signed regulatory.db and other firmware\0" + "From\0zohar@linux.vnet.ibm.com (Mimi Zohar)\0" + "Subject\0[PATCH 3/6] firmware: differentiate between signed regulatory.db and other firmware\0" "Date\0Fri, 11 May 2018 01:00:26 -0400\0" - "To\0Luis R. Rodriguez <mcgrof@kernel.org>\0" - "Cc\0Matthew Garrett <mjg59@srcf.ucam.org>" - Peter Jones <pjones@redhat.com> - AKASHI - Takahiro <takahiro.akashi@linaro.org> - David Howells <dhowells@redhat.com> - linux-wireless <linux-wireless@vger.kernel.org> - Kalle Valo <kvalo@codeaurora.org> - Seth Forshee <seth.forshee@canonical.com> - Johannes Berg <johannes.berg@intel.com> - linux-integrity@vger.kernel.org - Hans de Goede <hdegoede@redhat.com> - Ard Biesheuvel <ard.biesheuvel@linaro.org> - linux-security-module@vger.kernel.org - linux-kernel@vger.kernel.org - Kees Cook <keescook@chromium.org> - Greg Kroah-Hartman <gregkh@linuxfoundation.org> - Andres Rodriguez <andresx7@gmail.com> - Linus Torvalds <torvalds@linux-foundation.org> - Andy Lutomirski <luto@kernel.org> - " Casey Schaufler <casey@schaufler-ca.com>\0" + "To\0linux-security-module@vger.kernel.org\0" "\00:1\0" "b\0" "On Thu, 2018-05-10 at 23:26 +0000, Luis R. Rodriguez wrote:\n" @@ -40,7 +20,7 @@ "> > On Wed, 2018-05-09 at 23:48 +0000, Luis R. Rodriguez wrote:\n" "> > > On Wed, May 09, 2018 at 06:06:57PM -0400, Mimi Zohar wrote:\n" "> > \n" - "> > > > > > Yes, writing regdb as a micro/mini LSM sounds reasonable. The LSM\n" + "> > > > > > Yes, writing regdb as a micro/mini LSM sounds reasonable. ?The LSM\n" "> > > > > > would differentiate between other firmware and the regulatory.db based\n" "> > > > > > on the firmware's pathname.\n" "> > > > > \n" @@ -49,7 +29,7 @@ "> > > > > regulatory db also doesn't make much sense.\n" "> > > > \n" "> > > > All calls to request_firmware() are already going through this LSM\n" - "> > > > hook. I should have said, it would be based on both READING_FIRMWARE\n" + "> > > > hook. ?I should have said, it would be based on both READING_FIRMWARE\n" "> > > > and the firmware's pathname.\n" "> > > \n" "> > > Yes, but it would still be a strcmp() computation added for all\n" @@ -62,15 +42,20 @@ "> Sorry but I must have missed this, can you send me the email or URL where he did that?\n" "> I never got a copy of that email I think.\n" "\n" - "My mistake. I've posted similar patches for kexec_load and for the\n" + "My mistake. ?I've posted similar patches for kexec_load and for the\n" "firmware sysfs fallback, both call security_kernel_read_file().\n" "Casey's comment was in regards to kexec_load[1], not for the sysfs\n" - "fallback mode. Here's the link to the most recent version of the\n" + "fallback mode. ?Here's the link to the most recent version of the\n" "kexec_load patches.[2]\n" "\n" - "[1] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006690.html\n" + "[1]?http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006690.html\n" "[2] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006854.html\n" "\n" - Mimi + "Mimi\n" + "\n" + "--\n" + "To unsubscribe from this list: send the line \"unsubscribe linux-security-module\" in\n" + "the body of a message to majordomo at vger.kernel.org\n" + More majordomo info at http://vger.kernel.org/majordomo-info.html -e23b20b7adbe11e9cf82169c72ce8b0d970a6d6fdd7834bf948a11264a4df5c9 +4f4f1101470eea55bbb89e030e6a16d48616a4b404a95d73e91e404af066e2c7
diff --git a/a/1.txt b/N2/1.txt index bfaca6a..a084e72 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -3,7 +3,7 @@ On Thu, 2018-05-10 at 23:26 +0000, Luis R. Rodriguez wrote: > > On Wed, 2018-05-09 at 23:48 +0000, Luis R. Rodriguez wrote: > > > On Wed, May 09, 2018 at 06:06:57PM -0400, Mimi Zohar wrote: > > -> > > > > > Yes, writing regdb as a micro/mini LSM sounds reasonable. The LSM +> > > > > > Yes, writing regdb as a micro/mini LSM sounds reasonable. The LSM > > > > > > would differentiate between other firmware and the regulatory.db based > > > > > > on the firmware's pathname. > > > > > @@ -12,7 +12,7 @@ On Thu, 2018-05-10 at 23:26 +0000, Luis R. Rodriguez wrote: > > > > > regulatory db also doesn't make much sense. > > > > > > > > All calls to request_firmware() are already going through this LSM -> > > > hook. I should have said, it would be based on both READING_FIRMWARE +> > > > hook. I should have said, it would be based on both READING_FIRMWARE > > > > and the firmware's pathname. > > > > > > Yes, but it would still be a strcmp() computation added for all @@ -25,13 +25,13 @@ On Thu, 2018-05-10 at 23:26 +0000, Luis R. Rodriguez wrote: > Sorry but I must have missed this, can you send me the email or URL where he did that? > I never got a copy of that email I think. -My mistake. I've posted similar patches for kexec_load and for the +My mistake. I've posted similar patches for kexec_load and for the firmware sysfs fallback, both call security_kernel_read_file(). Casey's comment was in regards to kexec_load[1], not for the sysfs -fallback mode. Here's the link to the most recent version of the +fallback mode. Here's the link to the most recent version of the kexec_load patches.[2] -[1] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006690.html +[1] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006690.html [2] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006854.html Mimi diff --git a/a/content_digest b/N2/content_digest index 771064e..32033ad 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -40,7 +40,7 @@ "> > On Wed, 2018-05-09 at 23:48 +0000, Luis R. Rodriguez wrote:\n" "> > > On Wed, May 09, 2018 at 06:06:57PM -0400, Mimi Zohar wrote:\n" "> > \n" - "> > > > > > Yes, writing regdb as a micro/mini LSM sounds reasonable. The LSM\n" + "> > > > > > Yes, writing regdb as a micro/mini LSM sounds reasonable. \302\240The LSM\n" "> > > > > > would differentiate between other firmware and the regulatory.db based\n" "> > > > > > on the firmware's pathname.\n" "> > > > > \n" @@ -49,7 +49,7 @@ "> > > > > regulatory db also doesn't make much sense.\n" "> > > > \n" "> > > > All calls to request_firmware() are already going through this LSM\n" - "> > > > hook. I should have said, it would be based on both READING_FIRMWARE\n" + "> > > > hook. \302\240I should have said, it would be based on both READING_FIRMWARE\n" "> > > > and the firmware's pathname.\n" "> > > \n" "> > > Yes, but it would still be a strcmp() computation added for all\n" @@ -62,15 +62,15 @@ "> Sorry but I must have missed this, can you send me the email or URL where he did that?\n" "> I never got a copy of that email I think.\n" "\n" - "My mistake. I've posted similar patches for kexec_load and for the\n" + "My mistake. \302\240I've posted similar patches for kexec_load and for the\n" "firmware sysfs fallback, both call security_kernel_read_file().\n" "Casey's comment was in regards to kexec_load[1], not for the sysfs\n" - "fallback mode. Here's the link to the most recent version of the\n" + "fallback mode. \302\240Here's the link to the most recent version of the\n" "kexec_load patches.[2]\n" "\n" - "[1] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006690.html\n" + "[1]\302\240http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006690.html\n" "[2] http://kernsec.org/pipermail/linux-security-module-archive/2018-May/006854.html\n" "\n" Mimi -e23b20b7adbe11e9cf82169c72ce8b0d970a6d6fdd7834bf948a11264a4df5c9 +2d455ae16e46b63eeaa620f617bcfbdaf2db50cac9f1e7c1244cad003e39da2f
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.