Re: [PATCH] ptrace: allow restriction of ptrace scope

[ebiederm@xmission.com (Eric W. Biederman)]

Casey Schaufler <casey@schaufler-ca.com> writes:

> Eric W. Biederman wrote:
>> Theodore Tso <tytso@MIT.EDU> writes:
>>
>>   
>>> i think we really need to have stacked LSM's,
>
> !
>
>>>  because there is a large set
>>> of people who will never use SELinux.  Every few years, I take another 
>>> look at SELinux, my head explodes with the (IMHO unneeded complexity),
>>> and I go away again...
>>>
>>> Yet I would really like a number of features such as this ptrace scope idea ---
>>> which I think is a useful feature, and it may be that stacking is the only
>>> way we can resolve this debate.   The SELinux people will never believe that
>>> their system is too complicated, and I don't like using things that are impossible
>>> for me to understand or configure, and that doesn't seem likely to change anytime
>>> in the near future.
>>>
>>> I mean, even IPSEC RFC's are easier for me to understand, and that's saying
>>> a lot...
>>>     
>>
>>
>> If anyone is going to work on this let me make a concrete suggestion.
>> Let's aim at not stacked lsm's but chained lsm's, and put the chaining
>> logic in the lsm core.
>>   
>
> It's 35 years since my data structures course. What's the important
> difference between the two?

Who takes responsibility for making it work, and where you implement
it.  If it is in the LSM it is a feature all LSMs automatically
support it.  If it is stacked it is an LSM by LSM feature.

Basically implementing chaining is just a walk over a list of
security_operations and calling the appropriate method on each one.

Stacked LSMs at least as I saw it in selinux was the implementation of
each security operation doing calling internally calling the secondary
lsm's security options.  Which seems to me to be more code, and harder
to maintain, and a setup that encourages politics.

>> The core difficulty appears to be how do you multiplex the security pointers
>> on various objects out there.
>>   
>
> That and making sure that the hooks that maintain state get called
> even if the decision to deny access has already been made by someone
> else.

Yep.

Except for dealing with state maintenance it is absolutely trivial
to implement chained LSMs.

Eric