--- David Howells <dhowells@redhat.com> wrote:

Casey Schaufler [off-list ref] wrote:

quoted

quoted

  (1) int security_get_context(void **_context);

	This allocates and gives the caller a blob that describes the current
	context of all the LSM module states attached to the current task and
	stores a pointer to it in *_context.

Is this intended to be anything more than a copy of current->security?

It has to be sufficient to fully effect security_push().

Which is why it requires an LSM interface. Just checking.

quoted

I assume that you're talking about the LSM specific data changing,
not the LSM itself.

Yes.

quoted

If you change the task->security information you are definitly going
to change what other tasks can do to the calling task.

I dealt with that in my current act-as patch.  Under SELinux a task has two
primary labels.  One with which it is labelled and is used to govern effects
upon it, and one that is used to act upon things and follows changes to the
former.

The specification of your push interface that the push operation
not affect how others access the process is OK for SELinux, but
not for any other MAC scheme that I've dealt with, and I think
that's most of them. Nuts. Smack, for example, uses exactly one
label on the process for all purposes.

Are you concerned about accesses other than signals? Signals
could be staitforward to deal with in a pushed situation, but
I'd hesitate to say that the solution would generalize without
additional thought.

quoted

quoted

  (5) int security_xfrm_to_kernel_context(void *from, void **_to);

Woof. What are you transforming from? 

In CacheFiles case, the cachefilesd daemon's security label into the label
the
cache driver acts as on behalf of other processes.

I'm not sure I understand what this is doing.


Casey Schaufler
casey@schaufler-ca.com