Date: Tue, 13 Jun 2017 22:59:59 +0200 From: Mickaël Salaün <mic@...ikod.net> To: Mimi Zohar <zohar@...ux.vnet.ibm.com>, Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>, keescook@...omium.org, matt@...tt.com Cc: jason@...finion.com, linux-security-module@...r.kernel.org, Daniel Micay <danielmicay@...il.com>, kernel-hardening <kernel-hardening@...ts.openwall.com>, LKML <linux-kernel@...r.kernel.org> Subject: Re: [PATCH v1] shebang: restrict python interactive prompt/interpreter On 12/06/2017 16:27, Mimi Zohar wrote: > On Sun, 2017-06-11 at 22:32 -0400, Mimi Zohar wrote: >> On Sun, 2017-06-11 at 13:44 +0200, Mickaël Salaün wrote: > >>> Using filesystem xattr seems like a good idea for this kind of >>> exceptions and instead of a hardcoded interpreter path. Something like >>> "security.tpe.interpreter=1|2" (bitmask for interpreter-only and/or CLI) >>> and "security.tpe.environment=HOME,LOGNAME" would be quite flexible to >>> configure a security policy for some binaries. This could also be >>> protected by IMA/EVM, if needed. >> >> Checking for the existence of an xattr without caching is relatively >> slow. I'm not sure that we would want to go this route. > > For identifying interpreters, xattrs would be too slow (without > caching results), but once identified, using xattrs as you suggested, > for specifying how interpreters can be invoked and limiting > environment variables, is a good idea. Perhaps the two xattrs could > be combined? Yes, caching results is definitely interesting. I think using one variable per usage is cleaner, though. Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.