From: Mimi Zohar <zohar@linux.ibm.com>
To: "Lev R. Oshvang ." <levonshe@gmail.com>,
"Mickaël Salaün" <mic@digikod.net>
Cc: "David Laight" <David.Laight@aculab.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"Aleksa Sarai" <cyphar@cyphar.com>,
"Alexei Starovoitov" <ast@kernel.org>,
"Al Viro" <viro@zeniv.linux.org.uk>,
"Andy Lutomirski" <luto@kernel.org>,
"Christian Heimes" <christian@python.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Deven Bowers" <deven.desai@linux.microsoft.com>,
"Eric Chiang" <ericchiang@google.com>,
"Florian Weimer" <fweimer@redhat.com>,
"James Morris" <jmorris@namei.org>, "Jan Kara" <jack@suse.cz>,
"Jann Horn" <jannh@google.com>,
"Jonathan Corbet" <corbet@lwn.net>,
"Kees Cook" <keescook@chromium.org>,
"Lakshmi Ramasubramanian" <nramas@linux.microsoft.com>,
"Matthew Garrett" <mjg59@google.com>,
"Matthew Wilcox" <willy@infradead.org>,
"Michael Kerrisk" <mtk.manpages@gmail.com>,
"Mickaël Salaün" <mickael.salaun@ssi.gouv.fr>,
"Philippe Trébuchet" <philippe.trebuchet@ssi.gouv.fr>,
"Scott Shell" <scottsh@microsoft.com>,
"Sean Christopherson" <sean.j.christopherson@intel.com>,
"Shuah Khan" <shuah@kernel.org>,
"Steve Dower" <steve.dower@python.org>,
"Steve Grubb" <sgrubb@redhat.com>,
"Thibaut Sautereau" <thibaut.sautereau@ssi.gouv.fr>,
"Vincent Strubel" <vincent.strubel@ssi.gouv.fr>,
"kernel-hardening@lists.openwall.com"
<kernel-hardening@lists.openwall.com>,
"linux-api@vger.kernel.org" <linux-api@vger.kernel.org>,
"linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>
Subject: Re: [PATCH v5 0/6] Add support for O_MAYEXEC
Date: Fri, 08 May 2020 10:01:07 -0400 [thread overview]
Message-ID: <1588946467.5146.6.camel@linux.ibm.com> (raw)
In-Reply-To: <CAP22eLFmNkeQNbmQ_SAbnrDUnv2W-zYJ+ijnE22C3ph2vUiQiQ@mail.gmail.com>
On Fri, 2020-05-08 at 10:15 +0300, Lev R. Oshvang . wrote:
> I can suggest something better ( I believe)
> Some time ago I proposed patch to IMA - Add suffix in IMA policy rule criteria
> It allows IMA to verify scripts, configuration files and even single file.
> It is very simple and does not depend on open flags.
> Mimi Zohar decided not to include this patch on the reason it tries to
> protect the file name.
> ( Why ??).
Your patch relies on the filename, but does nothing to protect it.
Mimi
prev parent reply other threads:[~2020-05-08 14:02 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-05 15:31 [PATCH v5 0/6] Add support for O_MAYEXEC Mickaël Salaün
2020-05-05 15:31 ` [PATCH v5 1/6] fs: Add support for an O_MAYEXEC flag on openat2(2) Mickaël Salaün
2020-05-12 21:05 ` Kees Cook
2020-05-12 21:40 ` Christian Heimes
2020-05-12 22:56 ` Kees Cook
2020-05-13 10:13 ` Mickaël Salaün
2020-05-05 15:31 ` [PATCH v5 2/6] fs: Add a MAY_EXECMOUNT flag to infer the noexec mount property Mickaël Salaün
2020-05-12 21:09 ` Kees Cook
2020-05-14 8:14 ` Lev R. Oshvang .
2020-05-14 15:48 ` Kees Cook
2020-05-17 16:57 ` Lev R. Oshvang .
2020-05-05 15:31 ` [PATCH v5 3/6] fs: Enable to enforce noexec mounts or file exec through O_MAYEXEC Mickaël Salaün
2020-05-05 15:44 ` Randy Dunlap
2020-05-05 16:55 ` Mickaël Salaün
2020-05-05 17:40 ` Randy Dunlap
2020-05-12 21:48 ` Kees Cook
2020-05-13 11:09 ` Mickaël Salaün
2020-05-13 15:37 ` Stephen Smalley
2020-05-13 23:27 ` Kees Cook
2020-05-14 3:05 ` Kees Cook
2020-05-14 10:12 ` David Laight
2020-05-14 12:22 ` Stephen Smalley
2020-05-14 14:41 ` Kees Cook
2020-05-14 15:52 ` Stephen Smalley
2020-05-14 15:45 ` Kees Cook
2020-05-14 16:10 ` Stephen Smalley
2020-05-14 19:16 ` Mickaël Salaün
2020-05-15 0:58 ` Tetsuo Handa
2020-05-15 8:01 ` How about just O_EXEC? (was Re: [PATCH v5 3/6] fs: Enable to enforce noexec mounts or file exec through O_MAYEXEC) Kees Cook
2020-05-15 8:43 ` Florian Weimer
2020-05-15 14:37 ` Kees Cook
2020-05-15 14:43 ` Florian Weimer
2020-05-15 15:50 ` Kees Cook
2020-05-18 7:26 ` Florian Weimer
2020-05-19 2:23 ` Aleksa Sarai
2020-05-19 10:13 ` Mickaël Salaün
2020-05-15 11:04 ` Mickaël Salaün
2020-05-15 15:46 ` Kees Cook
2020-05-15 18:24 ` Mickaël Salaün
2020-05-14 19:21 ` [PATCH v5 3/6] fs: Enable to enforce noexec mounts or file exec through O_MAYEXEC Mickaël Salaün
2020-05-05 15:31 ` [PATCH v5 4/6] selftest/openat2: Add tests for O_MAYEXEC enforcing Mickaël Salaün
2020-05-12 21:57 ` Kees Cook
2020-05-13 11:18 ` Mickaël Salaün
2020-05-05 15:31 ` [PATCH v5 5/6] doc: Add documentation for the fs.open_mayexec_enforce sysctl Mickaël Salaün
2020-05-12 22:00 ` Kees Cook
2020-05-13 11:20 ` Mickaël Salaün
2020-05-05 15:31 ` [PATCH v5 6/6] ima: add policy support for the new file open MAY_OPENEXEC flag Mickaël Salaün
2020-05-05 15:36 ` [PATCH v5 0/6] Add support for O_MAYEXEC Mickaël Salaün
2020-05-06 13:58 ` Lev R. Oshvang .
2020-05-06 15:41 ` Aleksa Sarai
2020-05-07 8:30 ` Mickaël Salaün
2020-05-07 8:05 ` David Laight
2020-05-07 8:36 ` Mickaël Salaün
2020-05-07 9:00 ` David Laight
2020-05-07 9:30 ` Mickaël Salaün
2020-05-07 9:44 ` David Laight
2020-05-07 13:38 ` Mickaël Salaün
2020-05-08 7:15 ` Lev R. Oshvang .
2020-05-08 14:01 ` Mimi Zohar [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1588946467.5146.6.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=David.Laight@aculab.com \
--cc=ast@kernel.org \
--cc=christian@python.org \
--cc=corbet@lwn.net \
--cc=cyphar@cyphar.com \
--cc=daniel@iogearbox.net \
--cc=deven.desai@linux.microsoft.com \
--cc=ericchiang@google.com \
--cc=fweimer@redhat.com \
--cc=jack@suse.cz \
--cc=jannh@google.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=levonshe@gmail.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mic@digikod.net \
--cc=mickael.salaun@ssi.gouv.fr \
--cc=mjg59@google.com \
--cc=mtk.manpages@gmail.com \
--cc=nramas@linux.microsoft.com \
--cc=philippe.trebuchet@ssi.gouv.fr \
--cc=scottsh@microsoft.com \
--cc=sean.j.christopherson@intel.com \
--cc=sgrubb@redhat.com \
--cc=shuah@kernel.org \
--cc=steve.dower@python.org \
--cc=thibaut.sautereau@ssi.gouv.fr \
--cc=vincent.strubel@ssi.gouv.fr \
--cc=viro@zeniv.linux.org.uk \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.