(off-list ancestor, not in this archive)
[PATCH v13 00/25] LSM: Module stacking for AppArmor · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-24
[PATCH v13 01/25] LSM: Infrastructure management of the sock security · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-24
[PATCH v13 02/25] LSM: Create and manage the lsmblob data structure. · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 02/25] LSM: Create and manage the lsmblob data structure. · Mickaël Salaün <mic@digikod.net> · 2019-12-25
[PATCH v13 03/25] LSM: Use lsmblob in security_audit_rule_match · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 03/25] LSM: Use lsmblob in security_audit_rule_match · Mimi Zohar <zohar@linux.ibm.com> · 2019-12-31
Re: [PATCH v13 03/25] LSM: Use lsmblob in security_audit_rule_match · Casey Schaufler <casey@schaufler-ca.com> · 2020-01-02
[PATCH v13 04/25] LSM: Use lsmblob in security_kernel_act_as · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 05/25] net: Prepare UDS for security module stacking · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 06/25] Use lsmblob in security_secctx_to_secid · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 06/25] Use lsmblob in security_secctx_to_secid · Stephen Smalley <hidden> · 2020-01-07
[PATCH v13 07/25] LSM: Use lsmblob in security_secid_to_secctx · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 08/25] LSM: Use lsmblob in security_ipc_getsecid · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 10/25] LSM: Use lsmblob in security_inode_getsecid · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 11/25] LSM: Use lsmblob in security_cred_getsecid · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 12/25] IMA: Change internal interfaces to use lsmblobs · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 13/25] LSM: Specify which LSM to display · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 13/25] LSM: Specify which LSM to display · Stephen Smalley <hidden> · 2020-01-07
[PATCH v13 14/25] LSM: Ensure the correct LSM context releaser · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 14/25] LSM: Ensure the correct LSM context releaser · Stephen Smalley <hidden> · 2020-01-07
[PATCH v13 15/25] LSM: Use lsmcontext in security_secid_to_secctx · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 15/25] LSM: Use lsmcontext in security_secid_to_secctx · Stephen Smalley <hidden> · 2020-01-06
[PATCH v13 17/25] LSM: Use lsmcontext in security_inode_getsecctx · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 16/25] LSM: Use lsmcontext in security_dentry_init_security · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 16/25] LSM: Use lsmcontext in security_dentry_init_security · Stephen Smalley <hidden> · 2020-01-07
[PATCH v13 18/25] LSM: security_secid_to_secctx in netlink netfilter · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 19/25] NET: Store LSM netlabel data in a lsmblob · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 19/25] NET: Store LSM netlabel data in a lsmblob · Stephen Smalley <hidden> · 2020-01-07
Re: [PATCH v13 19/25] NET: Store LSM netlabel data in a lsmblob · Casey Schaufler <casey@schaufler-ca.com> · 2020-01-07
Re: [PATCH v13 19/25] NET: Store LSM netlabel data in a lsmblob · Stephen Smalley <hidden> · 2020-01-09
[PATCH v13 20/25] LSM: Verify LSM display sanity in binder · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 21/25] Audit: Add subj_LSM fields when necessary · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 09/25] LSM: Use lsmblob in security_task_getsecid · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 09/25] LSM: Use lsmblob in security_task_getsecid · Stephen Smalley <hidden> · 2020-01-07
[PATCH v13 22/25] Audit: Include object data for all security modules · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH v13 23/25] NET: Add SO_PEERCONTEXT for multiple LSMs · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH v13 23/25] NET: Add SO_PEERCONTEXT for multiple LSMs · Stephen Smalley <hidden> · 2020-01-06
Re: [PATCH v13 23/25] NET: Add SO_PEERCONTEXT for multiple LSMs · Simon McVittie <hidden> · 2020-01-06
Re: [PATCH v13 23/25] NET: Add SO_PEERCONTEXT for multiple LSMs · Casey Schaufler <casey@schaufler-ca.com> · 2020-01-06
Re: [PATCH v13 23/25] NET: Add SO_PEERCONTEXT for multiple LSMs · Stephen Smalley <hidden> · 2020-01-06
Re: [PATCH v13 23/25] NET: Add SO_PEERCONTEXT for multiple LSMs · Stephen Smalley <hidden> · 2020-01-06
[PATCH v13 25/25] AppArmor: Remove the exclusive flag · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
[PATCH 24/25] LSM: Add /proc attr entry for full LSM context · Casey Schaufler <casey@schaufler-ca.com> · 2019-12-25
Re: [PATCH 24/25] LSM: Add /proc attr entry for full LSM context · Stephen Smalley <hidden> · 2020-01-06
[PATCH v13 26/25] Audit: Multiple LSM support in audit rules · Casey Schaufler <casey@schaufler-ca.com> · 2020-01-03
Re: [PATCH v13 26/25] Audit: Multiple LSM support in audit rules · Mimi Zohar <zohar@linux.ibm.com> · 2020-01-09
Re: [PATCH v13 26/25] Audit: Multiple LSM support in audit rules · Casey Schaufler <casey@schaufler-ca.com> · 2020-01-10
Re: [PATCH v13 26/25] Audit: Multiple LSM support in audit rules · Mimi Zohar <zohar@linux.ibm.com> · 2020-01-12

Re: [PATCH v13 26/25] Audit: Multiple LSM support in audit rules

From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2020-01-09 16:33:41
Also in: linux-integrity, selinux

Hi Casey,

On Fri, 2020-01-03 at 10:53 -0800, Casey Schaufler wrote:

With multiple possible security modules supporting audit rule
it is necessary to keep separate data for each module in the
audit rules. This affects IMA as well, as it re-uses the audit
rule list mechanisms.

While reviewing this patch, I realized there was a bug in the base IMA
code.  With Janne's bug fix, that he just posted, I think this patch
can now be simplified.

My main concern is the number of warning messages that will be
generated.  Any time a new LSM policy is loaded, the labels will be
re-evaulated whether or not they are applicable to the particular LSM,
causing unnecessary warnings.

Mimi

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help