Re: Stacking - anyone care how to report module id's?

dwheelerat_private

This seems reasonable (currently SELinux uses the convention but with
the "-n" flag, but that's easily handled as a special case).
HOWEVER, that means that an implementation of MD5 has to be
available to the stacker.  My current plan is to simply call everything,
and later on if that's a problem, I could switch to using the md5
(if enough people would follow the convention!).

Since the documentation now includes some text about the convention,
perhaps more people will follow it :-).  The documentation could
be modified to hint that your module might not stack in the future
if it DIDN'T follow the convention.

Crispin Cowan wrote:

> Chris Wright wrote:
> 
>> This is how I'd do it as well (of course, with the unlock bug that
>> Greg pointed out fixed ;-).  I know Crispin doesn't find this elegant,
>> but the overhead is not critical, and it's consistent with other bits
>> of the kernel (for example, binfmt handlers) and even other projects
>> (apache module handling is done this way).
>>
>> If this polling style leaves a sour taste you could certainly create
>> a stacker protocol that does more efficient dispatching.  The
>> mod_reg_security() interface (which the subordinate modules will use
>> to register with the stacker) contains the parts necessary to do this.
>> The name string could be required (by stacker protocol) to be one of two
>> things: 1) the string used by the module when generating the md5sum'd ID;
>> 2) the string version of the ID.  You get the idea...
>>
> The idea above came about from chatting with Chris this afternoon. 
> There's something really neat here, which I don't think is conveyed in 
> the text above.
> 
> Previously, Wheeler proposed that the module ID should be defined as the 
> first 32 bits of the MD5 of the module's name. One & all liked that 
> idea, but did not agree on a strict specification of the text to be fed 
> to MD5 to come up with this checksum, leading to module ID ambiguity, 
> etc. etc.
> 
> Now suppose that the Stacker module imposes (only on modules to be 
> stacked by Stacker, of course) a strict protocol in which the module ID 
> is exactly the MD5 of the name fed to mod_reg_security(). Its important 
> that it be strict, because Stacker can use this name to compute the ID 
> of the module just loaded.
> 
> So, with no change in the interface at all, Wheeler can do indexed 
> lookup of modules. All that is required is for modules that want to play 
> with Stacker stictly conform to Stacker's view of the mapping from name 
> to ID.
> 
> Chris tells me that he vaguely recalls one of the players here who used 
> the entire project title phrase as the MD5 input, rather than the short 
> name. I suspect that most everyone used some variation on their own 
> name. IMHO, just having a strict interpretation of what you should MD5 
> to get your ID # is a benefit in itself.
> 
> Crispin
> 

-- 

--- David A. Wheeler
     dwheelerat_private

_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module