Re: [RFC PATCH 0/5] kdbus: add support for lsm

[Karol Lewandowski <lmctlx@gmail.com>]

On Fri, Nov 07, 2014 at 10:01:20AM -0800, Greg KH wrote:
> On Fri, Oct 31, 2014 at 05:36:32PM +0100, Karol Lewandowski wrote:
> > This is set of EXPERIMENTAL patches adding lsm support to kdbus.
> > (Rebased on top of v3.17.)
> > 
> > >From least to most invasive:
> > 
> >  - (1) kdbus: extend structures with security pointer for lsm
> > 
> >    Trivial.  Applicable as-is.
> > 
> >  - (2) security: export security_file_receive for modules
> >    (3) kdbus: check if lsm permits installing received fds
> > 
> >    fd_install doesn't seem to consult LSM, these patches
> >    ensure that receiving process has the right to sent fds. 
> > 
> >    Compile-tested only.
> > 
> >  - (4) security: introduce lsm hooks for kdbus
> >    (5) kdbus: make use of new lsm hooks
> > 
> >    Set of proof-of-concept hooks discussed previously with Paul Moore.
> > 
> >    kdbus integration patch (5) for review, but unlikely for integration
> >    at this stage.
> > 
> >    Likewise, compile-tested only.
> > 
> > 
> > Karol Lewandowski (5):
> >   kdbus: extend structures with security pointer for lsm
> >   security: export security_file_receive for modules
> >   kdbus: check if lsm permits installing received fds
> >   security: introduce lsm hooks for kdbus
> >   kdbus: make use of new lsm hooks
> 
> These looks reasonable to me, thanks for sending them.  They will need
> to be refreshed again after this next round of changes, but it shouldn't
> be that hard to do so.

Sure thing.

For completness - there are accompanying Smack and SELinux patches that
could go together with above patches, ie.

  https://github.com/lmctl/linux/commit/103c26fd27d1ec8c32d85dd3d85681f936ac66fb

  http://git.infradead.org/users/pcmoore/selinux/commitdiff/eef4844f91fef6092b6bfac941ebe7f18375be9d

I've got some free time on my hands now, so I'll try to revisit these too.

Cheers,
Karol Lewandowski