From: Dave Quigley <dpquigl@davequigley.com>
To: "J. Bruce Fields" <bfields@fieldses.org>
Cc: "David P. Quigley" <selinux@davequigley.com>,
trond.myklebust@netapp.com, sds@tycho.nsa.gov,
linux-nfs@vger.kernel.org, selinux@tycho.nsa.gov,
linux-security-module@vger.kernel.org,
"Matthew N. Dodd" <Matthew.Dodd@sparta.com>,
Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg>,
Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg>,
Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg>
Subject: Re: [PATCH 02/13] Security: Add Hook to test if the particular xattr is part of a MAC model.
Date: Mon, 12 Nov 2012 19:12:13 -0500 [thread overview]
Message-ID: <50A1905D.2070608@davequigley.com> (raw)
In-Reply-To: <20121112214357.GC23169@fieldses.org>
On 11/12/2012 4:43 PM, J. Bruce Fields wrote:
> On Mon, Nov 12, 2012 at 02:36:09PM -0500, David P. Quigley wrote:
>> On 11/12/2012 11:36 AM, J. Bruce Fields wrote:
>>> On Mon, Nov 12, 2012 at 09:56:37AM -0500, Dave Quigley wrote:
>>>> On 11/12/2012 7:15 AM, J. Bruce Fields wrote:
>>>>> On Mon, Nov 12, 2012 at 01:15:36AM -0500, David Quigley wrote:
>>>>>> From: David Quigley<dpquigl@davequigley.com>
>>>>>>
>>>>>> The interface to request security labels from user space is the xattr
>>>>>> interface. When requesting the security label from an NFS server it is
>>>>>> important to make sure the requested xattr
>>>>> I'm confused--clients can't request xattrs from NFS servers. I must be
>>>>> reading this wrong, but I'm not sure what you meant.
>>>>>
>>>>> --b.
>>>>>
>>>> Generically clients can't use xattrs from NFS servers but the LSM
>>>> method for getting labels is through the xattr interface. THe point
>>>> of this is if someone selects security.capability that we don't
>>>> translate that into a call in labeled nfs to get the security label.
>>>> We only want label based LSMs to cause a getfattr on the server to
>>>> grab the label and populate the inode with that information.
>>>> Currently if you use security.selinux or security.smack then labeled
>>>> nfs will handle the translation of that into a get/setfattr on the
>>>> security_label attribute in NFSv4.
>>> OK, I think I understand: so this is to help the NFS client implement
>>> the necessary xattr interface for userspace that get and sets security
>>> labels on NFS filesystems?
>>>
>>> --b.
>>
>> Exactly. The problem is we don't want to have LSM specific logic in
>> so the best we can do is ask if the security.* xattr being accessed
>> has the proper semantics to be used with Labeled NFS.
>
> OK, thanks. The changelog could probably be clarified (at least make it
> clear that this is for the client side.)
>
> Delaying this patch till right before the patch that actually uses it
> might also help (and/or even combining those two patches).
>
> --b.
>
I should be able to rearrange them and change the patch text. Merging
probably isn't a good idea since all of this code is in LSMs so it seems
weird to put it in with the NFS code.
WARNING: multiple messages have this Message-ID (diff)
From: Dave Quigley <dpquigl@davequigley.com>
To: "J. Bruce Fields" <bfields@fieldses.org>
Cc: "David P. Quigley" <selinux@davequigley.com>,
trond.myklebust@netapp.com, sds@tycho.nsa.gov,
linux-nfs@vger.kernel.org, selinux@tycho.nsa.gov,
linux-security-module@vger.kernel.org,
"Matthew N. Dodd" <Matthew.Dodd@sparta.com>,
Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg>,
Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg>,
Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg>
Subject: Re: [PATCH 02/13] Security: Add Hook to test if the particular xattr is part of a MAC model.
Date: Mon, 12 Nov 2012 19:12:13 -0500 [thread overview]
Message-ID: <50A1905D.2070608@davequigley.com> (raw)
In-Reply-To: <20121112214357.GC23169@fieldses.org>
On 11/12/2012 4:43 PM, J. Bruce Fields wrote:
> On Mon, Nov 12, 2012 at 02:36:09PM -0500, David P. Quigley wrote:
>> On 11/12/2012 11:36 AM, J. Bruce Fields wrote:
>>> On Mon, Nov 12, 2012 at 09:56:37AM -0500, Dave Quigley wrote:
>>>> On 11/12/2012 7:15 AM, J. Bruce Fields wrote:
>>>>> On Mon, Nov 12, 2012 at 01:15:36AM -0500, David Quigley wrote:
>>>>>> From: David Quigley<dpquigl@davequigley.com>
>>>>>>
>>>>>> The interface to request security labels from user space is the xattr
>>>>>> interface. When requesting the security label from an NFS server it is
>>>>>> important to make sure the requested xattr
>>>>> I'm confused--clients can't request xattrs from NFS servers. I must be
>>>>> reading this wrong, but I'm not sure what you meant.
>>>>>
>>>>> --b.
>>>>>
>>>> Generically clients can't use xattrs from NFS servers but the LSM
>>>> method for getting labels is through the xattr interface. THe point
>>>> of this is if someone selects security.capability that we don't
>>>> translate that into a call in labeled nfs to get the security label.
>>>> We only want label based LSMs to cause a getfattr on the server to
>>>> grab the label and populate the inode with that information.
>>>> Currently if you use security.selinux or security.smack then labeled
>>>> nfs will handle the translation of that into a get/setfattr on the
>>>> security_label attribute in NFSv4.
>>> OK, I think I understand: so this is to help the NFS client implement
>>> the necessary xattr interface for userspace that get and sets security
>>> labels on NFS filesystems?
>>>
>>> --b.
>>
>> Exactly. The problem is we don't want to have LSM specific logic in
>> so the best we can do is ask if the security.* xattr being accessed
>> has the proper semantics to be used with Labeled NFS.
>
> OK, thanks. The changelog could probably be clarified (at least make it
> clear that this is for the client side.)
>
> Delaying this patch till right before the patch that actually uses it
> might also help (and/or even combining those two patches).
>
> --b.
>
I should be able to rearrange them and change the patch text. Merging
probably isn't a good idea since all of this code is in LSMs so it seems
weird to put it in with the NFS code.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2012-11-13 0:12 UTC|newest]
Thread overview: 162+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-12 6:15 Labeled NFS [v5] David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 6:15 ` [PATCH 01/13] Security: Add hook to calculate context based on a negative dentry David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 12:13 ` J. Bruce Fields
2012-11-12 14:52 ` Dave Quigley
2012-11-12 14:52 ` Dave Quigley
2012-11-12 6:15 ` [PATCH 02/13] Security: Add Hook to test if the particular xattr is part of a MAC model David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 12:15 ` J. Bruce Fields
2012-11-12 14:56 ` Dave Quigley
2012-11-12 14:56 ` Dave Quigley
2012-11-12 16:36 ` J. Bruce Fields
2012-11-12 19:36 ` David P. Quigley
2012-11-12 19:36 ` David P. Quigley
2012-11-12 21:43 ` J. Bruce Fields
2012-11-13 0:12 ` Dave Quigley [this message]
2012-11-13 0:12 ` Dave Quigley
2012-11-12 6:15 ` [PATCH 03/13] LSM: Add flags field to security_sb_set_mnt_opts for in kernel mount data David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 6:15 ` [PATCH 04/13] SELinux: Add new labeling type native labels David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 6:15 ` [PATCH 05/13] KConfig: Add KConfig entries for Labeled NFS David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 14:45 ` J. Bruce Fields
2012-11-12 14:57 ` Dave Quigley
2012-11-12 14:57 ` Dave Quigley
2012-11-12 6:15 ` [PATCH 06/13] NFSv4: Add label recommended attribute and NFSv4 flags David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 6:15 ` [PATCH 07/13] NFSv4: Introduce new label structure David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 15:13 ` J. Bruce Fields
2012-11-12 15:32 ` David P. Quigley
2012-11-12 15:32 ` David P. Quigley
2012-11-12 16:05 ` J. Bruce Fields
2012-11-12 16:53 ` David P. Quigley
2012-11-12 16:53 ` David P. Quigley
2012-11-12 17:50 ` J. Bruce Fields
2012-11-12 6:15 ` [PATCH 08/13] NFSv4: Extend fattr bitmaps to support all 3 words David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 6:15 ` [PATCH 09/13] NFS:Add labels to client function prototypes David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 6:15 ` [PATCH 10/13] NFS: Add label lifecycle management David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 15:33 ` J. Bruce Fields
2012-11-12 15:36 ` David P. Quigley
2012-11-12 15:36 ` David P. Quigley
2012-11-12 6:15 ` [PATCH 11/13] NFS: Client implementation of Labeled-NFS David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 6:15 ` [PATCH 12/13] NFS: Extend NFS xattr handlers to accept the security namespace David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 6:15 ` [PATCH 13/13] NFSD: Server implementation of MAC Labeling David Quigley
2012-11-12 6:15 ` David Quigley
2012-11-12 16:31 ` J. Bruce Fields
2012-11-12 15:23 ` Labeled NFS [v5] J. Bruce Fields
2012-11-12 15:34 ` David P. Quigley
2012-11-12 15:34 ` David P. Quigley
2012-11-12 16:09 ` J. Bruce Fields
2012-11-12 20:56 ` Steve Dickson
2012-11-13 1:39 ` Dave Quigley
2012-11-13 1:39 ` Dave Quigley
2012-11-13 12:55 ` Steve Dickson
2012-11-14 4:32 ` Dave Quigley
2012-11-14 4:32 ` Dave Quigley
2012-11-14 13:45 ` J. Bruce Fields
2012-11-14 13:50 ` David Quigley
2012-11-14 13:50 ` David Quigley
2012-11-14 13:59 ` J. Bruce Fields
2012-11-14 14:01 ` David Quigley
2012-11-14 14:01 ` David Quigley
2012-11-14 14:04 ` David Quigley
2012-11-14 14:04 ` David Quigley
2012-11-14 14:24 ` J. Bruce Fields
2012-11-14 14:30 ` David Quigley
2012-11-14 14:30 ` David Quigley
2012-11-15 16:00 ` Casey Schaufler
2012-11-15 16:00 ` Casey Schaufler
2012-11-15 20:28 ` David Quigley
2012-11-15 20:28 ` David Quigley
2012-11-16 3:34 ` Casey Schaufler
2012-11-16 3:34 ` Casey Schaufler
2012-11-16 3:43 ` David Quigley
2012-11-16 3:43 ` David Quigley
2012-11-16 4:58 ` Dave Quigley
2012-11-16 4:58 ` Dave Quigley
2012-11-16 4:59 ` Dave Quigley
2012-11-16 4:59 ` Dave Quigley
2012-11-14 13:56 ` David Quigley
2012-11-14 13:56 ` David Quigley
2012-11-12 16:33 ` J. Bruce Fields
2012-11-12 20:44 ` Dave Quigley
2012-11-12 20:44 ` Dave Quigley
2012-11-12 22:23 ` Casey Schaufler
2012-11-12 22:23 ` Casey Schaufler
2012-11-13 3:16 ` Dave Quigley
2012-11-13 3:16 ` Dave Quigley
2012-11-20 21:09 ` Casey Schaufler
2012-11-20 21:09 ` Casey Schaufler
2012-11-21 0:04 ` Dave Quigley
2012-11-21 0:04 ` Dave Quigley
2012-11-21 0:29 ` Dave Quigley
2012-11-21 0:29 ` Dave Quigley
2012-11-21 0:32 ` Casey Schaufler
2012-11-21 0:32 ` Casey Schaufler
2012-11-21 0:37 ` Dave Quigley
2012-11-21 0:37 ` Dave Quigley
2012-11-21 2:52 ` Casey Schaufler
2012-11-21 2:52 ` Casey Schaufler
2012-11-21 3:28 ` Dave Quigley
2012-11-21 3:28 ` Dave Quigley
2012-11-28 18:57 ` Casey Schaufler
2012-11-29 1:14 ` Dave Quigley
2012-11-29 1:14 ` Dave Quigley
2012-11-29 2:08 ` Casey Schaufler
2012-11-29 22:28 ` Casey Schaufler
2012-11-29 22:28 ` Casey Schaufler
2012-11-29 22:49 ` David Quigley
2012-11-29 22:49 ` David Quigley
2012-11-30 0:02 ` David Quigley
2012-11-30 0:02 ` David Quigley
2012-11-30 0:07 ` David Quigley
2012-11-30 0:07 ` David Quigley
2012-11-30 0:34 ` Casey Schaufler
2012-11-30 0:34 ` Casey Schaufler
2012-11-30 0:46 ` David Quigley
2012-11-30 0:46 ` David Quigley
2012-11-30 1:50 ` Casey Schaufler
2012-11-30 1:50 ` Casey Schaufler
2012-11-30 2:02 ` David Quigley
2012-11-30 2:02 ` David Quigley
2012-11-30 12:14 ` J. Bruce Fields
2012-11-30 12:57 ` David Quigley
2012-11-30 12:57 ` David Quigley
2012-11-30 13:17 ` David Quigley
2012-11-30 13:17 ` David Quigley
2012-11-30 13:28 ` Stephen Smalley
2012-11-30 13:28 ` Stephen Smalley
2012-11-30 13:35 ` David Quigley
2012-11-30 13:35 ` David Quigley
2012-11-30 13:50 ` Stephen Smalley
2012-11-30 13:50 ` Stephen Smalley
2012-11-30 14:02 ` David Quigley
2012-11-30 14:02 ` David Quigley
2012-11-30 16:21 ` Casey Schaufler
2012-11-30 16:21 ` Casey Schaufler
2012-11-30 16:28 ` David Quigley
2012-11-30 16:28 ` David Quigley
2012-12-03 18:27 ` Casey Schaufler
2012-12-03 18:27 ` Casey Schaufler
2012-11-30 16:55 ` J. Bruce Fields
2012-11-30 16:59 ` David Quigley
2012-11-30 16:59 ` David Quigley
2012-11-30 13:20 ` David Quigley
2012-11-30 13:20 ` David Quigley
-- strict thread matches above, loose matches on Subject: below --
2012-12-17 15:42 [PATCH 00/13] NFSv4: Label NFS Patches Steve Dickson
2012-12-17 15:43 ` [PATCH 02/13] Security: Add Hook to test if the particular xattr is part of a MAC model Steve Dickson
2013-05-13 19:11 [PATCH 00/13] lnfs: linux-3.10-rc1 release Steve Dickson
2013-05-13 19:11 ` [PATCH 02/13] Security: Add Hook to test if the particular xattr is part of a MAC model Steve Dickson
2013-05-16 15:56 Froe e71bf1d708e1294b3bae64d04f03228b3625f2a3 Mon Sep 17 00:00:00 2001 Steve Dickson
2013-05-16 15:56 ` [PATCH 02/13] Security: Add Hook to test if the particular xattr is part of a MAC model Steve Dickson
2013-05-16 15:56 ` Steve Dickson
2013-05-20 21:15 ` Eric Paris
2013-05-20 21:15 ` Eric Paris
2013-05-20 21:15 ` Eric Paris
2013-05-22 16:50 [PATCH 00/13] lnfs: 3.10-rc2 release Steve Dickson
2013-05-22 16:50 ` [PATCH 02/13] Security: Add Hook to test if the particular xattr is part of a MAC model Steve Dickson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50A1905D.2070608@davequigley.com \
--to=dpquigl@davequigley.com \
--cc=Matthew.Dodd@sparta.com \
--cc=Mi_Mi_AUNG@dsi.a-star.edu.sg \
--cc=PHUA_Eu_Gene@dsi.a-star.edu.sg \
--cc=Rodel_FM@dsi.a-star.edu.sg \
--cc=bfields@fieldses.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=selinux@davequigley.com \
--cc=selinux@tycho.nsa.gov \
--cc=trond.myklebust@netapp.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.