Re: [RFC] LSM changes for 2.5.38

From: Stephen Smalley (sdsat_private)
Date: Fri Sep 27 2002 - 05:09:50 PDT

  • Next message: Stephen Smalley: "Re: [RFC] No more module_* hooks"

    On Fri, 27 Sep 2002, Christoph Hellwig wrote:
    
    > Sorry, but this is bullshit (like most of the lsm changes).  Either you
    > leave the capable in and say it's enough or you add your random hook
    > and remove that one.  Just adding more and more hooks without thinking
    > gets us exactly nowhere except to an unmaintainable codebase.
    
    The LSM hooks are primarily restrictive, i.e. a security module can deny
    access that would normally be granted by the existing Linux access checks.
    Hence, the LSM patch does not remove existing access checks.  Minimal
    support for permissive behavior (granting what would normally be denied)
    is provided to support modularization of the capabilities logic, but this
    does not require removing the capable() calls from kernel functions.  This
    approach reduces the invasiveness of the patch and the likelihood of
    introducing bugs into the base kernel access checking.  See the LSM papers
    from Usenix Security and OLS, which should be available from
    lsm.immunix.org.
    
    > Also is there a _real_ need to pass in all the arguments?
    
    Define _real_.  It is true that none of the existing open source security
    modules presently use this particular hook.  SELinux doesn't presently use
    it, but it seems reasonable to support finer-grained control over ioperm()
    than the all-or-nothing CAP_SYS_RAWIO.  Is the criteria that every hook
    and every parameter to every hook must be used by an existing open source
    security module?  If so, then yes, this hook can be dropped.
    
    > Umm, you can't tell me you deny someone to initialize a module he has
    > just created?
    
    In sys_create_module, you only know the name and size of the module and
    who is performing the operation.  In sys_init_module, you actually have
    information about the module available.  Hence, you can make a
    finer-grained decision in the module_initialize hook, and possibly deny
    even after a successful module_create.  As above, SELinux doesn't use
    these hooks presently.
    
    > You don't think this should maybe be just one hook?
    
    They are different operations, with different interpretations of the
    string parameter.  If your security module is enforcing any kind of
    restriction based on the parameter, then you need to distinguish them.
    Again, not used by SELinux at present.
    
    > Aha.  So every LS module knows about every single sysctl in the
    > kernel.  Common, this is silly guys (and girls if there any)!
    
    SELinux does use the sysctl hook.  It assigns security labels to sysctl
    variables and enforces a consistent control whether accessed via the
    sysctl() call or the /proc/sys interface.  The granularity at which you
    distinguish the sysctl variables is configurable.  For example, we assign
    an individual security label to /proc/sys/kernel/modprobe to suport
    fine-grained control over access to it.  Most sysctl variables are grouped
    into equivalence classes based on the hierarchy, but it is entirely
    configurable in the security policy.
    
    --
    Stephen D. Smalley, NAI Labs
    ssmalleyat_private
    
    
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Fri Sep 27 2002 - 05:11:23 PDT