Date: Sat, 2 Sep 2017 08:31:05 +0200 From: Djalal Harouni <tixxdz@...il.com> To: Kees Cook <keescook@...gle.com> Cc: "Serge E. Hallyn" <serge@...lyn.com>, Rusty Russell <rusty@...tcorp.com.au>, "David S . Miller" <davem@...emloft.net>, Jessica Yu <jeyu@...hat.com>, LKML <linux-kernel@...r.kernel.org>, Network Development <netdev@...r.kernel.org>, linux-security-module <linux-security-module@...r.kernel.org>, "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>, Andy Lutomirski <luto@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>, James Morris <james.l.morris@...cle.com>, Paul Moore <paul@...l-moore.com>, Stephen Smalley <sds@...ho.nsa.gov>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>, Ingo Molnar <mingo@...nel.org>, Linux API <linux-api@...r.kernel.org>, Dongsu Park <dpark@...teo.net>, Casey Schaufler <casey@...aufler-ca.com>, Jonathan Corbet <corbet@....net>, Arnaldo Carvalho de Melo <acme@...hat.com>, Mauro Carvalho Chehab <mchehab@...nel.org>, Peter Zijlstra <peterz@...radead.org>, Zendyani <zendyani@...il.com>, "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>, Al Viro <viro@...iv.linux.org.uk>, Ben Hutchings <ben.hutchings@...ethink.co.uk> Subject: Re: [PATCH v4 next 1/3] modules:capabilities: allow __request_module() to take a capability argument Hi Kees, On Thu, Jun 1, 2017 at 9:10 PM, Kees Cook <keescook@...gle.com> wrote: > On Thu, Jun 1, 2017 at 7:56 AM, Djalal Harouni <tixxdz@...il.com> wrote: ... > >> BTW Kees, also in next version I won't remove the >> capable(CAP_NET_ADMIN) check from  >> even if there is the new request_module_cap(), I would like it to be >> in a different patches, this way we go incremental >> and maybe it is better to merge what we have now ? and follow up >> later, and of course if other maintainers agree too! > > Yes, incremental. I would suggest first creating the API changes to > move a basic require_cap test into the LSM (which would drop the > open-coded capable() checks in the net code), and then add the > autoload logic in the following patches. That way the "infrastructure" > changes happen separately and do not change any behaviors, but moves > the caps test down where its wanted in the LSM, before then augmenting > the logic. > >> I just need a bit of free time to check again everything and will send >> a v5 with all requested changes. > > Great, thank you! > So sorry was busy these last months, I picked it again, will send v5 after the merge window. Kees I am looking on a way to integrate a test for it, we should use something like the example here  or maybe something else ? and which module to use ? I still did not sort this out, if anyone has some suggestions, thank you in advance!  http://openwall.com/lists/kernel-hardening/2017/05/22/7 -- tixxdz
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.