From: Kees Cook <keescook@chromium.org>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org,
john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
paul@paul-moore.com, Stephen Smalley <sds@tycho.nsa.gov>
Subject: Re: [PATCH 05/58] LSM: Use lsm_export in the inode_getsecid hooks
Date: Thu, 6 Jun 2019 12:11:44 -0700 [thread overview]
Message-ID: <201906061141.77FE9A9@keescook> (raw)
In-Reply-To: <46c5cbbb-b703-403f-96dd-d90f49d74e5e@schaufler-ca.com>
On Mon, Jun 03, 2019 at 05:29:45PM -0700, Casey Schaufler wrote:
> On 6/1/2019 6:57 PM, Kees Cook wrote:
> > On Fri, May 31, 2019 at 04:09:27PM -0700, Casey Schaufler wrote:
> >> Convert the inode_getsecid hooks to use the lsm_export
> >> structure instead of a u32 secid. There is some scaffolding
> >> involved that will be removed when security_inode_getsecid()
> >> is updated.
> > So, there are like 20 patches that all have basically identical subject
> > and changelog, but some evolve the API in subtle ways. For example,
> > in this patch, there is no mention of adding lsm_export_init(). I would
> > expect all the lsm_export infrastructure and support functions to be
> > introduced in patch 4 where struct lsm_export is initially introduced.
>
> Fair enough. I didn't introduce helpers until they were used.
> I hoped to avoid the "what is this for?" question that can
> come up when you add functions that aren't used.
True, but since we know a giant set of changes is coming, I think it's
okay. As long there's kerndoc on the helpers, it should be clear what
they're for. And the commit log can include the context for why the
helpers exist. "In later patches, we'll replace secids with lsm_context,
so we need to use foo to do bar etc"
> > Instead, various helper functions are scattered through these patches
> > and I'm left struggling to figure out where things are actually
> > changing.
>
> I think it's possible that the patches may be too small
> to contain enough context for them to be sensible. It may
> make things more obvious if I combined
>
> [PATCH 05/58] LSM: Use lsm_export in the inode_getsecid hooks
> [PATCH 20/58] LSM: Use lsm_export in security_inode_getsecid
>
> into a single patch. That would reduce the amount of scaffolding
> that has to get set up and torn down.
Yeah, that's fine. If you have to do a lot of work to split up a pair of
patches, I think that's fine to combine them. What I usually want to see
is a split of separable changes. Like, adding all the helpers: I can
look at those individually as I read the patch. Then the next patch
might swap a whole logical set of things like putting lsm_context into
the LSMs, but leaving all the interfaces alone. Then fixing the high
level things that use secids, etc.
But, really, the cover letter should cover the evolutionary steps the
series takes: that should serve as a guide for everything trying to
follow your thinking.
> The inconsistency is comes from my use of "lsm_export" for
> the name of the LSM data structure. This is something you've
> commented on elsewhere. The underscore makes the function name
> look like it has an lsm_ prefix, rather than just being the
> name of the structure. If I changed "struct lsm_export" to
> "struct lsmdata" the names:
>
> lsm_lsmdata_to_secid() and smack_secid_to_lsmdata()
> would be more consistent.
Right. Having a distinct verb in the helper name should solve all my
confusion. :)
lsm_context_to_secid() secid_to_lsm_context() smack_secid_to_lsm_export()
etc
> > Which brings me to another thing I find awkward here: I feel like an LSM
> > shouldn't need to do anything with this object: it should be opaque to
> > the LSM. The LSM infrastructure knows which LSM it has called into. Why
> > isn't this just like the other blobs?
>
> There's a lot more rework required if the lsm_export has to be
> life-cycle managed. The audit code, for example, passes them about,
> copying, storing and dropping them without a care. I'm not completely
> opposed to taking that on, but it's essentially a rewrite of the
> audit LSM handling. The SO_PEERSEC handling probably has issues as
> well. I think netlabel would be OK, but there's stuff going on elsewhere
> in the networking stack that isn't going to like anything it has to
> worry about allocating and/or freeing.
I didn't mean life-cycle managed, but rather "opaque" to LSM. I just now
tried to construct an example, and have decided it's too crazy. :) The
benefits of your current system are that they are trivially able to be
put on the stack since they're a fixed size. The down side is that each
LSM must manage its own flags, etc. I will ponder alternatives after I
see the next version of your series.
--
Kees Cook
next prev parent reply other threads:[~2019-06-06 19:11 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-31 23:09 [PATCH 00/58] LSM: Module stacking for AppArmor Casey Schaufler
2019-05-31 23:09 ` [PATCH 01/58] LSM: Infrastructure management of the superblock Casey Schaufler
2019-06-01 15:15 ` Kees Cook
2019-05-31 23:09 ` [PATCH 02/58] LSM: Infrastructure management of the sock security Casey Schaufler
2019-06-01 15:17 ` Kees Cook
2019-05-31 23:09 ` [PATCH 03/58] LSM: Infrastructure management of the key security blob Casey Schaufler
2019-06-01 15:18 ` Kees Cook
2019-05-31 23:09 ` [PATCH 04/58] LSM: Create an lsm_export data structure Casey Schaufler
2019-06-01 15:23 ` Kees Cook
2019-06-03 20:07 ` Casey Schaufler
2019-05-31 23:09 ` [PATCH 05/58] LSM: Use lsm_export in the inode_getsecid hooks Casey Schaufler
2019-06-02 1:57 ` Kees Cook
2019-06-04 0:29 ` Casey Schaufler
2019-06-06 19:11 ` Kees Cook [this message]
2019-05-31 23:09 ` [PATCH 06/58] LSM: Use lsm_export in the cred_getsecid hooks Casey Schaufler
2019-05-31 23:09 ` [PATCH 07/58] LSM: Use lsm_export in the ipc_getsecid and task_getsecid hooks Casey Schaufler
2019-05-31 23:09 ` [PATCH 08/58] LSM: Use lsm_export in the kernel_ask_as hooks Casey Schaufler
2019-05-31 23:09 ` [PATCH 09/58] LSM: Use lsm_export in the getpeersec_dgram hooks Casey Schaufler
2019-05-31 23:09 ` [PATCH 10/58] LSM: Use lsm_export in the audit_rule_match hooks Casey Schaufler
2019-05-31 23:09 ` [PATCH 11/58] LSM: Use lsm_export in the secid_to_secctx hooks Casey Schaufler
2019-05-31 23:09 ` [PATCH 12/58] LSM: Use lsm_export in the secctx_to_secid hooks Casey Schaufler
2019-05-31 23:09 ` [PATCH 13/58] LSM: Use lsm_export in security_audit_rule_match Casey Schaufler
2019-05-31 23:09 ` [PATCH 14/58] LSM: Use lsm_export in security_kernel_act_as Casey Schaufler
2019-05-31 23:09 ` [PATCH 15/58] LSM: Use lsm_export in security_socket_getpeersec_dgram Casey Schaufler
2019-05-31 23:09 ` [PATCH 16/58] LSM: Use lsm_export in security_secctx_to_secid Casey Schaufler
2019-05-31 23:09 ` [PATCH 17/58] LSM: Use lsm_export in security_secid_to_secctx Casey Schaufler
2019-05-31 23:09 ` [PATCH 18/58] LSM: Use lsm_export in security_ipc_getsecid Casey Schaufler
2019-05-31 23:09 ` [PATCH 19/58] LSM: Use lsm_export in security_task_getsecid Casey Schaufler
2019-05-31 23:09 ` [PATCH 20/58] LSM: Use lsm_export in security_inode_getsecid Casey Schaufler
2019-05-31 23:09 ` [PATCH 21/58] LSM: Use lsm_export in security_cred_getsecid Casey Schaufler
2019-05-31 23:09 ` [PATCH 22/58] Audit: Change audit_sig_sid to audit_sig_lsm Casey Schaufler
2019-06-02 2:03 ` Kees Cook
2019-06-03 22:23 ` Casey Schaufler
2019-06-06 18:41 ` Kees Cook
2019-06-06 19:17 ` Casey Schaufler
2019-06-06 20:53 ` Kees Cook
2019-06-06 21:06 ` Casey Schaufler
2019-06-06 22:53 ` Kees Cook
2019-05-31 23:09 ` [PATCH 23/58] Audit: Convert target_sid to an lsm_export structure Casey Schaufler
2019-05-31 23:09 ` [PATCH 24/58] Audit: Convert osid " Casey Schaufler
2019-05-31 23:09 ` [PATCH 25/58] IMA: Clean out lsm_export scaffolding Casey Schaufler
2019-06-02 2:06 ` Kees Cook
2019-06-03 21:40 ` Casey Schaufler
2019-05-31 23:09 ` [PATCH 26/58] NET: Change the UNIXCB from a secid to an lsm_export Casey Schaufler
2019-05-31 23:09 ` [PATCH 27/58] NET: Remove scaffolding on secmarks Casey Schaufler
2019-05-31 23:09 ` [PATCH 28/58] NET: Remove scaffolding on new secmarks Casey Schaufler
2019-05-31 23:09 ` [PATCH 29/58] NET: Remove netfilter scaffolding for lsm_export Casey Schaufler
2019-05-31 23:09 ` [PATCH 30/58] Netlabel: Replace secids with lsm_export Casey Schaufler
2019-05-31 23:09 ` [PATCH 31/58] LSM: Remove lsm_export scaffolding functions Casey Schaufler
2019-05-31 23:09 ` [PATCH 32/58] IMA: FIXUP prototype using lsm_export Casey Schaufler
2019-05-31 23:09 ` [PATCH 33/58] Smack: Restore the release_secctx hook Casey Schaufler
2019-05-31 23:09 ` [PATCH 34/58] AppArmor: Remove unnecessary hook stub Casey Schaufler
2019-05-31 23:09 ` [PATCH 35/58] LSM: Limit calls to certain module hooks Casey Schaufler
2019-05-31 23:09 ` [PATCH 36/58] LSM: Create a data structure for a security context Casey Schaufler
2019-05-31 23:09 ` [PATCH 37/58] LSM: Use lsm_context in secid_to_secctx hooks Casey Schaufler
2019-05-31 23:10 ` [PATCH 38/58] LSM: Use lsm_context in secctx_to_secid hooks Casey Schaufler
2019-05-31 23:10 ` [PATCH 39/58] LSM: Use lsm_context in inode_getsecctx hooks Casey Schaufler
2019-05-31 23:10 ` [PATCH 40/58] LSM: Use lsm_context in inode_notifysecctx hooks Casey Schaufler
2019-05-31 23:10 ` [PATCH 41/58] LSM: Use lsm_context in dentry_init_security hooks Casey Schaufler
2019-05-31 23:10 ` [PATCH 42/58] LSM: Use lsm_context in security_dentry_init_security Casey Schaufler
2019-05-31 23:10 ` [PATCH 43/58] LSM: Use lsm_context in security_inode_notifysecctx Casey Schaufler
2019-05-31 23:10 ` [PATCH 44/58] LSM: Use lsm_context in security_inode_getsecctx Casey Schaufler
2019-05-31 23:10 ` [PATCH 45/58] LSM: Use lsm_context in security_secctx_to_secid Casey Schaufler
2019-05-31 23:10 ` [PATCH 46/58] LSM: Use lsm_context in release_secctx hooks Casey Schaufler
2019-06-02 2:27 ` Kees Cook
2019-06-03 21:57 ` Casey Schaufler
2019-05-31 23:10 ` [PATCH 47/58] LSM: Use lsm_context in security_release_secctx Casey Schaufler
2019-05-31 23:10 ` [PATCH 48/58] LSM: Use lsm_context in security_secid_to_secctx Casey Schaufler
2019-05-31 23:10 ` [PATCH 49/58] fs: remove lsm_context scaffolding Casey Schaufler
2019-05-31 23:10 ` [PATCH 50/58] LSM: Add the release function to the lsm_context Casey Schaufler
2019-06-01 15:13 ` [PATCH 00/58] LSM: Module stacking for AppArmor Kees Cook
2019-06-02 2:56 ` Kees Cook
-- strict thread matches above, loose matches on Subject: below --
2019-05-31 23:30 Casey Schaufler
2019-05-31 23:30 ` [PATCH 05/58] LSM: Use lsm_export in the inode_getsecid hooks Casey Schaufler
2019-06-02 16:50 [PATCH 00/58] LSM: Module stacking for AppArmor Casey Schaufler
2019-06-02 16:50 ` [PATCH 05/58] LSM: Use lsm_export in the inode_getsecid hooks Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201906061141.77FE9A9@keescook \
--to=keescook@chromium.org \
--cc=casey.schaufler@intel.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).