From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from jazzdrum.ncsc.mil (zombie.ncsc.mil [144.51.88.131]) by tarius.tycho.ncsc.mil (8.13.1/8.13.1) with SMTP id l7DGwFbd005076 for ; Mon, 13 Aug 2007 12:58:15 -0400 Received: from web36606.mail.mud.yahoo.com (jazzdrum.ncsc.mil [144.51.5.7]) by jazzdrum.ncsc.mil (8.12.10/8.12.10) with SMTP id l7DGwEDa019159 for ; Mon, 13 Aug 2007 16:58:14 GMT Date: Mon, 13 Aug 2007 09:58:08 -0700 (PDT) From: Casey Schaufler Reply-To: casey@schaufler-ca.com Subject: Re: [PATCH 00/16] Permit filesystem local caching [try #3] To: David Howells , casey@schaufler-ca.com Cc: dhowells@redhat.com, Stephen Smalley , torvalds@osdl.org, akpm@osdl.org, steved@redhat.com, trond.myklebust@fys.uio.no, linux-fsdevel@vger.kernel.org, linux-cachefs@redhat.com, nfsv4@linux-nfs.org, linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov, LSM List In-Reply-To: <13221.1187022703@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Message-ID: <959629.46851.qm@web36606.mail.mud.yahoo.com> Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov --- David Howells wrote: > Casey Schaufler wrote: > > > > (1) int security_get_context(void **_context); > > > > > > This allocates and gives the caller a blob that describes the current > > > context of all the LSM module states attached to the current task and > > > stores a pointer to it in *_context. > > > > Is this intended to be anything more than a copy of current->security? > > It has to be sufficient to fully effect security_push(). Which is why it requires an LSM interface. Just checking. > > I assume that you're talking about the LSM specific data changing, > > not the LSM itself. > > Yes. > > > If you change the task->security information you are definitly going > > to change what other tasks can do to the calling task. > > I dealt with that in my current act-as patch. Under SELinux a task has two > primary labels. One with which it is labelled and is used to govern effects > upon it, and one that is used to act upon things and follows changes to the > former. The specification of your push interface that the push operation not affect how others access the process is OK for SELinux, but not for any other MAC scheme that I've dealt with, and I think that's most of them. Nuts. Smack, for example, uses exactly one label on the process for all purposes. Are you concerned about accesses other than signals? Signals could be staitforward to deal with in a pushed situation, but I'd hesitate to say that the solution would generalize without additional thought. > > > (5) int security_xfrm_to_kernel_context(void *from, void **_to); > > > > Woof. What are you transforming from? > > In CacheFiles case, the cachefilesd daemon's security label into the label > the > cache driver acts as on behalf of other processes. I'm not sure I understand what this is doing. Casey Schaufler casey@schaufler-ca.com -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S943064AbXHMRO2 (ORCPT ); Mon, 13 Aug 2007 13:14:28 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1032080AbXHMQ6O (ORCPT ); Mon, 13 Aug 2007 12:58:14 -0400 Received: from web36606.mail.mud.yahoo.com ([209.191.85.23]:33751 "HELO web36606.mail.mud.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S965847AbXHMQ6L (ORCPT ); Mon, 13 Aug 2007 12:58:11 -0400 X-YMail-OSG: B5HNFzAVM1lgPM03BSBV4l76rbJgsBPhTTHYMXF9Fs8aNWCEh6zaczymx_xOF1Vf06n.A.m.Dg-- X-RocketYMMF: rancidfat Date: Mon, 13 Aug 2007 09:58:08 -0700 (PDT) From: Casey Schaufler Reply-To: casey@schaufler-ca.com Subject: Re: [PATCH 00/16] Permit filesystem local caching [try #3] To: David Howells , casey@schaufler-ca.com Cc: dhowells@redhat.com, Stephen Smalley , torvalds@osdl.org, akpm@osdl.org, steved@redhat.com, trond.myklebust@fys.uio.no, linux-fsdevel@vger.kernel.org, linux-cachefs@redhat.com, nfsv4@linux-nfs.org, linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov, LSM List In-Reply-To: <13221.1187022703@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT Message-ID: <959629.46851.qm@web36606.mail.mud.yahoo.com> Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org --- David Howells wrote: > Casey Schaufler wrote: > > > > (1) int security_get_context(void **_context); > > > > > > This allocates and gives the caller a blob that describes the current > > > context of all the LSM module states attached to the current task and > > > stores a pointer to it in *_context. > > > > Is this intended to be anything more than a copy of current->security? > > It has to be sufficient to fully effect security_push(). Which is why it requires an LSM interface. Just checking. > > I assume that you're talking about the LSM specific data changing, > > not the LSM itself. > > Yes. > > > If you change the task->security information you are definitly going > > to change what other tasks can do to the calling task. > > I dealt with that in my current act-as patch. Under SELinux a task has two > primary labels. One with which it is labelled and is used to govern effects > upon it, and one that is used to act upon things and follows changes to the > former. The specification of your push interface that the push operation not affect how others access the process is OK for SELinux, but not for any other MAC scheme that I've dealt with, and I think that's most of them. Nuts. Smack, for example, uses exactly one label on the process for all purposes. Are you concerned about accesses other than signals? Signals could be staitforward to deal with in a pushed situation, but I'd hesitate to say that the solution would generalize without additional thought. > > > (5) int security_xfrm_to_kernel_context(void *from, void **_to); > > > > Woof. What are you transforming from? > > In CacheFiles case, the cachefilesd daemon's security label into the label > the > cache driver acts as on behalf of other processes. I'm not sure I understand what this is doing. Casey Schaufler casey@schaufler-ca.com From mboxrd@z Thu Jan 1 00:00:00 1970 From: Casey Schaufler Subject: Re: [PATCH 00/16] Permit filesystem local caching [try #3] Date: Mon, 13 Aug 2007 09:58:08 -0700 (PDT) Message-ID: <959629.46851.qm@web36606.mail.mud.yahoo.com> References: <13221.1187022703@redhat.com> Reply-To: casey@schaufler-ca.com, Linux filesystem caching discussion list Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Cc: akpm@osdl.org, LSM List , linux-kernel@vger.kernel.org, nfsv4@linux-nfs.org, trond.myklebust@fys.uio.no, torvalds@osdl.org, linux-cachefs@redhat.com, selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org, Stephen Smalley To: David Howells , casey@schaufler-ca.com Return-path: In-Reply-To: <13221.1187022703@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-cachefs-bounces@redhat.com Errors-To: linux-cachefs-bounces@redhat.com List-Id: linux-fsdevel.vger.kernel.org --- David Howells wrote: > Casey Schaufler wrote: >=20 > > > (1) int security_get_context(void **_context); > > >=20 > > > This allocates and gives the caller a blob that describes the curr= ent > > > context of all the LSM module states attached to the current task = and > > > stores a pointer to it in *_context. > >=20 > > Is this intended to be anything more than a copy of current->security= ? >=20 > It has to be sufficient to fully effect security_push(). Which is why it requires an LSM interface. Just checking. > > I assume that you're talking about the LSM specific data changing, > > not the LSM itself. >=20 > Yes. >=20 > > If you change the task->security information you are definitly going > > to change what other tasks can do to the calling task. >=20 > I dealt with that in my current act-as patch. Under SELinux a task has= two > primary labels. One with which it is labelled and is used to govern ef= fects > upon it, and one that is used to act upon things and follows changes to= the > former. The specification of your push interface that the push operation not affect how others access the process is OK for SELinux, but not for any other MAC scheme that I've dealt with, and I think that's most of them. Nuts. Smack, for example, uses exactly one label on the process for all purposes. Are you concerned about accesses other than signals? Signals could be staitforward to deal with in a pushed situation, but I'd hesitate to say that the solution would generalize without additional thought. > > > (5) int security_xfrm_to_kernel_context(void *from, void **_to); > >=20 > > Woof. What are you transforming from?=20 >=20 > In CacheFiles case, the cachefilesd daemon's security label into the la= bel > the > cache driver acts as on behalf of other processes. I'm not sure I understand what this is doing. Casey Schaufler casey@schaufler-ca.com