From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: KP Singh <kpsingh@kernel.org>,
linux-security-module@vger.kernel.org, bpf@vger.kernel.org
Cc: ast@kernel.org, paul@paul-moore.com, casey@schaufler-ca.com,
andrii@kernel.org, keescook@chromium.org, daniel@iogearbox.net,
renauld@google.com, revest@chromium.org, song@kernel.org
Subject: Re: [PATCH v12 0/5] Reduce overhead of LSMs with static calls
Date: Sat, 18 May 2024 15:01:03 +0900 [thread overview]
Message-ID: <c5bbc4fc-e632-4aa2-aee9-e0ef271d4e30@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <20240516003524.143243-1-kpsingh@kernel.org>
On 2024/05/16 9:35, KP Singh wrote:
> Since we know the address of the enabled LSM callbacks at compile time and only
> the order is determined at boot time, the LSM framework can allocate static
> calls for each of the possible LSM callbacks and these calls can be updated once
> the order is determined at boot.
I don't like this assumption. None of built-in LSMs is used by (or affordable for)
my customers. There is a reality that only out-of-tree security modules which the
distributor (namely, Red Hat) cannot support (and therefore cannot be built into
RHEL kernels) are used by (or affordable for) such customers.
Therefore, without giving room for allowing such security modules to load after
boot, I consider this change a regression.
next prev parent reply other threads:[~2024-05-18 6:02 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-16 0:35 [PATCH v12 0/5] Reduce overhead of LSMs with static calls KP Singh
2024-05-16 0:35 ` [PATCH v12 1/5] kernel: Add helper macros for loop unrolling KP Singh
2024-05-17 8:03 ` John Johansen
2024-05-16 0:35 ` [PATCH v12 2/5] security: Count the LSMs enabled at compile time KP Singh
2024-05-17 8:09 ` John Johansen
2024-05-16 0:35 ` [PATCH v12 3/5] security: Replace indirect LSM hook calls with static calls KP Singh
2024-06-27 20:28 ` Jonathan Corbet
2024-06-29 8:28 ` KP Singh
2024-05-16 0:35 ` [PATCH v12 4/5] security: Update non standard hooks to use " KP Singh
2024-05-16 0:35 ` [PATCH v12 5/5] bpf: Only enable BPF LSM hooks when an LSM program is attached KP Singh
2024-06-11 1:05 ` Paul Moore
2024-06-29 8:13 ` KP Singh
2024-07-01 23:40 ` Paul Moore
2024-05-18 6:01 ` Tetsuo Handa [this message]
2024-06-06 15:58 ` [PATCH v12 0/5] Reduce overhead of LSMs with static calls Kees Cook
2024-06-06 16:36 ` Paul Moore
2024-06-06 18:07 ` Kees Cook
2024-06-06 20:07 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c5bbc4fc-e632-4aa2-aee9-e0ef271d4e30@I-love.SAKURA.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=casey@schaufler-ca.com \
--cc=daniel@iogearbox.net \
--cc=keescook@chromium.org \
--cc=kpsingh@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=renauld@google.com \
--cc=revest@chromium.org \
--cc=song@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox