From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [PATCH V34 00/29] Lockdown as an LSM Date: Tue, 25 Jun 2019 16:04:15 +1000 (AEST) Message-ID: References: <20190622000358.19895-1-matthewgarrett@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Matthew Garrett Cc: LSM List , Linux Kernel Mailing List , Linux API , Stephen Smalley , Andy Lutomirski , John Johansen , Casey Schaufler List-Id: linux-api@vger.kernel.org On Mon, 24 Jun 2019, Matthew Garrett wrote: > > We are still not resolved on granularity. Stephen has said he's not sure > > if a useful policy can be constructed with just confidentiality and > > integrity settings. I'd be interested to know JJ and Casey's thoughts on > > lockdown policy flexibility wrt their respective LSMs. > > This implementation provides arbitrary granularity at the LSM level, > though the lockdown LSM itself only provides two levels. Other LSMs > can choose an appropriate level of exposure. Ahh, OK, I only looked at the patchset description and had not looked at V33 yet. This is looking good. -- James Morris