From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH 1/2] lsm: Add hooks to the TUN driver Date: Fri, 28 Aug 2009 15:46:36 -0700 (PDT) Message-ID: <20090828.154636.192870325.davem@davemloft.net> References: <20090828220400.3900.64377.stgit@flek.lan> <20090828221243.3900.15668.stgit@flek.lan> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov To: unlisted-recipients:; (no To-header on input) Return-path: In-Reply-To: <20090828221243.3900.15668.stgit@flek.lan> Sender: linux-security-module-owner@vger.kernel.org List-Id: netdev.vger.kernel.org From: Paul Moore Date: Fri, 28 Aug 2009 18:12:43 -0400 > The TUN driver lacks any LSM hooks which makes it difficult for LSM modules, > such as SELinux, to enforce access controls on network traffic generated by > TUN users; this is particularly problematic for virtualization apps such as > QEMU and KVM. This patch adds three new LSM hooks designed to control the > creation and attachment of TUN devices, the hooks are: > > * security_tun_dev_create() > Provides access control for the creation of new TUN devices > > * security_tun_dev_post_create() > Provides the ability to create the necessary socket LSM state for newly > created TUN devices > > * security_tun_dev_attach() > Provides access control for attaching to existing, persistent TUN devices > and the ability to update the TUN device's socket LSM state as necessary > > Signed-off-by: Paul Moore > Acked-by: Eric Paris > Acked-by: Serge Hallyn I'm happy if you guys merge this via the security tree, feel free to add: Acked-by: David S. Miller