From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: Chenbo Feng <fengc@google.com>,
Jeffrey Vander Stoep <jeffv@google.com>,
Stephen Smalley <sds@tycho.nsa.gov>,
netdev@vger.kernel.org, SELinux <Selinux@tycho.nsa.gov>,
mic@digikod.net
Subject: Re: Permissions for eBPF objects
Date: Fri, 25 Aug 2017 18:03:32 -0700 [thread overview]
Message-ID: <20170826010330.tuospq5h43fv3tlp@ast-mbp> (raw)
In-Reply-To: <59A0837F.9090301@iogearbox.net>
On Fri, Aug 25, 2017 at 10:07:27PM +0200, Daniel Borkmann wrote:
> On 08/25/2017 09:52 PM, Chenbo Feng wrote:
> > On Fri, Aug 25, 2017 at 12:45 PM, Jeffrey Vander Stoep <jeffv@google.com> wrote:
> > > On Fri, Aug 25, 2017 at 12:26 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> > > > On Fri, 2017-08-25 at 11:01 -0700, Jeffrey Vander Stoep via Selinux
> > > > wrote:
> > > > > I’d like to get your thoughts on adding LSM permission checks on BPF
> > > > > objects.
before reinventing the wheel please take a look at landlock work.
Everything that was discussed in this thread is covered by it.
The patches have been in development for more than a year and most of the early
issues have been resolved.
It will be presented again during security summit in LA in September.
next prev parent reply other threads:[~2017-08-26 1:03 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-25 18:01 Permissions for eBPF objects Jeffrey Vander Stoep
[not found] ` <CABXk95AiYO7D8o79TBdt0_0g1TXfULSpL5i7KzHF3R4i-WhwHw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-08-25 19:26 ` Stephen Smalley
2017-08-25 19:45 ` Jeffrey Vander Stoep
2017-08-25 19:52 ` Chenbo Feng
2017-08-25 20:07 ` Daniel Borkmann
2017-08-26 1:03 ` Alexei Starovoitov [this message]
2017-08-29 0:47 ` Chenbo Feng
2017-08-29 1:15 ` Alexei Starovoitov
2017-08-29 1:44 ` Chenbo Feng
2017-08-29 22:23 ` Mickaël Salaün
[not found] ` <CAMOXUJkQ-Wh==9nzgx3Sq4RUEBK5ArHk4b=AL0N65L9g6cAqcg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-08-25 20:40 ` Stephen Smalley
2017-08-25 20:49 ` Chenbo Feng
2017-08-25 20:04 ` Casey Schaufler
-- strict thread matches above, loose matches on Subject: below --
2017-08-25 17:56 Jeffrey Vander Stoep via Selinux
[not found] ` <CABXk95ATb_AFk+4GX9Xw+HEU6No8irb0mOoLE9O4EBuLAgA-1w-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-08-25 18:03 ` Jeffrey Vander Stoep via Selinux
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170826010330.tuospq5h43fv3tlp@ast-mbp \
--to=alexei.starovoitov@gmail.com \
--cc=Selinux@tycho.nsa.gov \
--cc=daniel@iogearbox.net \
--cc=fengc@google.com \
--cc=jeffv@google.com \
--cc=mic@digikod.net \
--cc=netdev@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox