From mboxrd@z Thu Jan 1 00:00:00 1970 From: Casey Schaufler Subject: Re: [RFC PATCH 2/2] cr: debug security_checkpoint_header and security_may_restart Date: Tue, 08 Sep 2009 21:43:36 -0700 Message-ID: <4AA73278.4030301@schaufler-ca.com> References: <20090903222824.GB27377@us.ibm.com> <20090903222853.GA27556@us.ibm.com> <4AA0A3AE.9040106@schaufler-ca.com> <20090904134611.GA11508@us.ibm.com> <4AA55183.4020407@schaufler-ca.com> <20090908041221.GB25161@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20090908041221.GB25161@us.ibm.com> Sender: linux-security-module-owner@vger.kernel.org To: "Serge E. Hallyn" Cc: Oren Laadan , Linux Containers , linux-security-module@vger.kernel.org, SELinux , Casey Schaufler List-Id: containers.vger.kernel.org Serge E. Hallyn wrote: > Quoting Casey Schaufler (casey@schaufler-ca.com): > >> Serge E. Hallyn wrote: >> >>> Quoting Casey Schaufler (casey@schaufler-ca.com): >>> >>> >>>> Serge E. Hallyn wrote: >>>> >>>> >>>>> This patch, for debugging only, introduces a silly admin-controlled >>>>> 'policy version' for smack. By default the version is 1. An >>>>> admin (with CAP_MAC_ADMIN) can change it by echoing a new value >>>>> into /smack/version. >>>>> >>>>> >>>>> >>>> The scheme you have suggested is just one step off of completely >>>> acceptable for real. More detail below, but if you make the "version" >>>> a string instead of a number I'm happy with it. In particular, a >>>> string that would itself be a valid Smack label makes everything >>>> really simple. >>>> >>>> >>> Presumably at many sites the version will be a unique string not >>> used as a label anywhere else. That's ok? >>> >>> >>> >>>> It would take me a few days, but if you're not in a real hurry or >>>> you're lazier than I am (yeah, right) I could provide a patch that >>>> does it. Or, if I haven't been completely incomprehensible, you >>>> could do a revision. >>>> >>>> >>> Heh, I'm in no hurry. I'll mark this to do midway next week, if >>> you haven't gotten around to it first. Thanks! >>> >>> >> I hate to be a bother, but what tree are you basing these patches on? >> Suspect that I missed a round of patches along the way, and can't apply >> the ones I do have. >> > > Sorry, the c/r tree is at: > > git://git.ncl.cs.columbia.edu/pub/git/linux-cr.git > The four patches from 08/28 (2-5) and the two from 09/03 are not happy applying to this tree. Am I missing a patch? From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from msux-gh1-uea02.nsa.gov (msux-gh1-uea02.nsa.gov [63.239.67.2]) by tarius.tycho.ncsc.mil (8.13.1/8.13.1) with ESMTP id n894hf9u018620 for ; Wed, 9 Sep 2009 00:43:41 -0400 Received: from smtp102.prem.mail.sp1.yahoo.com (localhost [127.0.0.1]) by msux-gh1-uea02.nsa.gov (8.12.10/8.12.10) with SMTP id n894j0xL014791 for ; Wed, 9 Sep 2009 04:45:00 GMT Message-ID: <4AA73278.4030301@schaufler-ca.com> Date: Tue, 08 Sep 2009 21:43:36 -0700 From: Casey Schaufler MIME-Version: 1.0 To: "Serge E. Hallyn" CC: Oren Laadan , Linux Containers , linux-security-module@vger.kernel.org, SELinux , Casey Schaufler Subject: Re: [RFC PATCH 2/2] cr: debug security_checkpoint_header and security_may_restart References: <20090903222824.GB27377@us.ibm.com> <20090903222853.GA27556@us.ibm.com> <4AA0A3AE.9040106@schaufler-ca.com> <20090904134611.GA11508@us.ibm.com> <4AA55183.4020407@schaufler-ca.com> <20090908041221.GB25161@us.ibm.com> In-Reply-To: <20090908041221.GB25161@us.ibm.com> Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov Serge E. Hallyn wrote: > Quoting Casey Schaufler (casey@schaufler-ca.com): > >> Serge E. Hallyn wrote: >> >>> Quoting Casey Schaufler (casey@schaufler-ca.com): >>> >>> >>>> Serge E. Hallyn wrote: >>>> >>>> >>>>> This patch, for debugging only, introduces a silly admin-controlled >>>>> 'policy version' for smack. By default the version is 1. An >>>>> admin (with CAP_MAC_ADMIN) can change it by echoing a new value >>>>> into /smack/version. >>>>> >>>>> >>>>> >>>> The scheme you have suggested is just one step off of completely >>>> acceptable for real. More detail below, but if you make the "version" >>>> a string instead of a number I'm happy with it. In particular, a >>>> string that would itself be a valid Smack label makes everything >>>> really simple. >>>> >>>> >>> Presumably at many sites the version will be a unique string not >>> used as a label anywhere else. That's ok? >>> >>> >>> >>>> It would take me a few days, but if you're not in a real hurry or >>>> you're lazier than I am (yeah, right) I could provide a patch that >>>> does it. Or, if I haven't been completely incomprehensible, you >>>> could do a revision. >>>> >>>> >>> Heh, I'm in no hurry. I'll mark this to do midway next week, if >>> you haven't gotten around to it first. Thanks! >>> >>> >> I hate to be a bother, but what tree are you basing these patches on? >> Suspect that I missed a round of patches along the way, and can't apply >> the ones I do have. >> > > Sorry, the c/r tree is at: > > git://git.ncl.cs.columbia.edu/pub/git/linux-cr.git > The four patches from 08/28 (2-5) and the two from 09/03 are not happy applying to this tree. Am I missing a patch? -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.