Re: [PATCH v11 3/9] LSM: Multiple concurrent LSMs

[Casey Schaufler <casey@schaufler-ca.com>]

On 12/20/2012 9:04 AM, Kees Cook wrote:
> On Wed, Dec 19, 2012 at 10:36 AM, Casey Schaufler
> <casey@schaufler-ca.com> wrote:
>> Subject: [PATCH v11 3/9] LSM: Multiple concurrent LSMs
>>
>> Change the infrastructure for Linux Security Modules (LSM)s
>> from a single vector of hook handlers to a list based method
>> for handling multiple concurrent modules.
>>
>> Handle any preconditions in the hooks directly.
>> Treat allocation and procattr hooks specially.
>>
>> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
>>
>> ---
>>  security/security.c | 1481 ++++++++++++++++++++++++++++++++++++++++-----------
>>  1 file changed, 1180 insertions(+), 301 deletions(-)
>>
>> diff --git a/security/security.c b/security/security.c
>> index 8dcd4ae..75e2f6e 100644
>> --- a/security/security.c
>> +++ b/security/security.c
>> [...]
>> +       lsm_enlist(sop, LSM_kernel_module_request, sop->kernel_module_request);
> kernel_module_from_file needs to get added too, now that the new
> syscall has been merged in Linus's tree.

That will be in the next version of the patch.




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.