testsuite meaning Linux Test Project / Autotest? We have a ChromeOS
Autotest for this already
(https://chromium.googlesource.com/chromiumos/third_party/autotest/+/master/client/site_tests/security_ProcessManagementPolicy/security_ProcessManagementPolicy.py)
but it would at least need some adaptation for configuring/flushing
policies during the test. Not sure how different Linux Autotests are
from ChromeOS, if they are used at all.

Also, could you point me at the directory that holds such test scripts
in the kernel tree? Shouldn't be too difficult to port that ChromeOS
autotest to a script if we want to go that route.

On Tue, Jan 29, 2019 at 9:25 AM James Morris [off-list ref] wrote:

On Mon, 28 Jan 2019, Micah Morton wrote:

quoted

FWIW, I've now done a manual test of this LSMs functionality on a
Linux VM built from the next-general branch. Adding policies, policy
enforcement by the LSM, and flushing policies all worked as intended.

So there hopefully won't be any more surprises.

It would be useful to publish these as a testsuite, or include a test
script in the kernel tree.

quoted

On Mon, Jan 28, 2019 at 12:19 PM Micah Morton [off-list ref] wrote:

quoted

On Mon, Jan 28, 2019 at 11:56 AM Kees Cook [off-list ref] wrote:

quoted

On Tue, Jan 29, 2019 at 8:47 AM Micah Morton [off-list ref] wrote:

quoted

I'm getting the following crash when booting after compiling a kernel
with this LSM enabled, so I'll have to figure out what is going on.
All the "core" functionality of this LSM has been tested thoroughly
(we're already using this LSM on ChromeOS), but looks like there's
some debugging of the initialization that still needs to be done.

+DEFINE_LSM(safesetid_security_init) = {
+       .init = safesetid_security_init,
+};

I think this is from not having:

.name = "safesetid",

That fixed it for me! Thanks

quoted

I missed that in the review, sorry!

--
Kees Cook

--
James Morris
[off-list ref]