From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Kara Subject: Re: [PATCH 1/1] Fanotify: Introduce a permissive mode Date: Tue, 15 Aug 2017 13:48:53 +0200 Message-ID: <20170815114853.GE27505@quack2.suse.cz> References: <3663877.NZSPRKlUQW@x2> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-fsdevel-owner@vger.kernel.org To: Amir Goldstein Cc: Steve Grubb , fsdevel , Linux Audit , Jan Kara List-Id: linux-audit@redhat.com On Tue 15-08-17 12:19:50, Amir Goldstein wrote: > On Mon, Aug 14, 2017 at 5:04 PM, Steve Grubb wrote: > > Hello, > > > > The fanotify interface can be used as an access control subsystem. If > > for some reason the policy is bad, there is potentially no good way to > > recover the system. This patch introduces a new command line variable, > > fanotify_enforce, to allow overriding the access decision from user > > space. The initialization status is recorded as an audit event so that > > there is a record of being in permissive mode for the security officer. > > :-/ overriding the security access decision sounds like a bad practice > *if* at all this method is acceptable overriding access decision should > probably be accompanied with pr_warn_ratelimited and a big warning > for fanotify_init with FAN_CLASS_{,PRE_}CONTENT priority. > > If the proposed kernel param is acceptable by others, I would prefer > that it prevents setting up FAN_CLASS_{,PRE_}CONTENT priority > watches, instead of setting them up and ignoring the user daemon response. Agreed. You need CAP_SYS_ADMIN to be able to set up watches for access control. If you have applications with CAP_SYS_ADMIN you don't trust, just don't run them or fix bugs in them. Kernel parameter is not the right way to fix broken applications with administrative priviledges. > I hope I am not out of line to propose: > > --- a/MAINTAINERS > +++ b/MAINTAINERS > > FANOTIFY > -M: Eric Paris > +M: Jan Kara > +R: Amir Goldstein > +L: linux-fsdevel@vger.kernel.org > S: Maintained > F: fs/notify/fanotify/ > F: include/linux/fanotify.h Yeah, I'll queue it up and the same for inotify & dnotify. Honza -- Jan Kara SUSE Labs, CR