| Message ID | 20190622000358.19895-1-matthewgarrett@google.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | Lockdown as an LSM | expand |
On Fri, 21 Jun 2019, Matthew Garrett wrote: > Minor updates over V33 - security_is_locked_down renamed to > security_locked_down, return value of security_locked_down is returned > in most cases, one unnecessary patch was dropped, couple of minor nits > fixed. Thanks for the respin. We are still not resolved on granularity. Stephen has said he's not sure if a useful policy can be constructed with just confidentiality and integrity settings. I'd be interested to know JJ and Casey's thoughts on lockdown policy flexibility wrt their respective LSMs. These are also "all or nothing" choices which may prevent deployment due to a user needing to allow (presumably controlled or mitigated) exceptions to the policy.
On 6/24/2019 4:01 PM, James Morris wrote: > On Fri, 21 Jun 2019, Matthew Garrett wrote: > >> Minor updates over V33 - security_is_locked_down renamed to >> security_locked_down, return value of security_locked_down is returned >> in most cases, one unnecessary patch was dropped, couple of minor nits >> fixed. > Thanks for the respin. > > We are still not resolved on granularity. Stephen has said he's not sure > if a useful policy can be constructed with just confidentiality and > integrity settings. I'd be interested to know JJ and Casey's thoughts on > lockdown policy flexibility wrt their respective LSMs. Smack is a mandatory access control mechanism on named objects controlled by the system. Issues of administrative control, like whether hibernation is allowed, are outside the scope of what Smack controls. There may be some subject/object implications, but I have not identified any yet. > These are also "all or nothing" choices which may prevent deployment due > to a user needing to allow (presumably controlled or mitigated) exceptions > to the policy.
On Mon, Jun 24, 2019 at 4:01 PM James Morris <jmorris@namei.org> wrote: > > On Fri, 21 Jun 2019, Matthew Garrett wrote: > > > Minor updates over V33 - security_is_locked_down renamed to > > security_locked_down, return value of security_locked_down is returned > > in most cases, one unnecessary patch was dropped, couple of minor nits > > fixed. > > Thanks for the respin. > > We are still not resolved on granularity. Stephen has said he's not sure > if a useful policy can be constructed with just confidentiality and > integrity settings. I'd be interested to know JJ and Casey's thoughts on > lockdown policy flexibility wrt their respective LSMs. This implementation provides arbitrary granularity at the LSM level, though the lockdown LSM itself only provides two levels. Other LSMs can choose an appropriate level of exposure. > These are also "all or nothing" choices which may prevent deployment due > to a user needing to allow (presumably controlled or mitigated) exceptions > to the policy. Distributions have been deploying the "all or nothing" solution for several years now, which implies that it's adequate for the common case. I think it's reasonable to punt finer grained policies over to other LSMs - people who want that are probably already using custom LSM policy.
On Mon, 24 Jun 2019, Matthew Garrett wrote: > > We are still not resolved on granularity. Stephen has said he's not sure > > if a useful policy can be constructed with just confidentiality and > > integrity settings. I'd be interested to know JJ and Casey's thoughts on > > lockdown policy flexibility wrt their respective LSMs. > > This implementation provides arbitrary granularity at the LSM level, > though the lockdown LSM itself only provides two levels. Other LSMs > can choose an appropriate level of exposure. Ahh, OK, I only looked at the patchset description and had not looked at V33 yet. This is looking good.
On 6/24/19 4:01 PM, James Morris wrote: > On Fri, 21 Jun 2019, Matthew Garrett wrote: > >> Minor updates over V33 - security_is_locked_down renamed to >> security_locked_down, return value of security_locked_down is returned >> in most cases, one unnecessary patch was dropped, couple of minor nits >> fixed. > > Thanks for the respin. > > We are still not resolved on granularity. Stephen has said he's not sure > if a useful policy can be constructed with just confidentiality and > integrity settings. I'd be interested to know JJ and Casey's thoughts on > lockdown policy flexibility wrt their respective LSMs. > > These are also "all or nothing" choices which may prevent deployment due > to a user needing to allow (presumably controlled or mitigated) exceptions > to the policy. > > I haven't gotten a chance to play with this the way I want to so there is still a lot of questions regarding its interaction with apparmor and its policy, but from what I have seen so far it is looking good. I expect the all or nothing choices may limit its deployments (we really need to play with this more to say) but we already face similar issues. There are options we provide at a distro level that we can't turn on by default, but we do recommend to more security conscious users. If lockdown was in kernel we would certainly make it available for our users, we have even had a few people ask about it.