From: Casey Schaufler <casey@schaufler-ca•com>
To: Stephen Smalley <sds@tycho•nsa.gov>
Cc: rongqing.li@windriver•com, netdev@vger•kernel.org,
selinux@tycho•nsa.gov, linux-security-module@vger•kernel.org,
Casey Schaufler <casey@schaufler-ca•com>
Subject: Re: [PATCH 1/2] Define security_sk_getsecctx
Date: Wed, 31 Aug 2011 13:49:57 -0700 [thread overview]
Message-ID: <4E5E9E75.8050305@schaufler-ca.com> (raw)
In-Reply-To: <1314816361.6850.51.camel@moss-pluto>
On 8/31/2011 11:46 AM, Stephen Smalley wrote:
> On Wed, 2011-08-31 at 08:43 -0700, Casey Schaufler wrote:
>> On 8/31/2011 1:36 AM, rongqing.li@windriver•com wrote:
>>> From: Roy.Li <rongqing.li@windriver•com>
>>>
>>> Define security_sk_getsecctx to return the security
>>> context of a sock.
>> So, what is the intended use of the information
>> coming from this hook? If I wanted to write the
>> Smack hook, which of the "contexts" would I want
>> to return? There are potentially three. If I know
>> what the caller is looking for, I can (hopefully)
>> select the correct information.
> The initial use case is for netstat -Z so that it can reliably show the
> security context of the socket rather than inferring it from the owning
> process, which can be inaccurate for security-aware applications.
>
> In your situation, when in != out, which would you rather see in netstat
> -Z output? Alternatively, if you want them both, perhaps you could
> combine in and out into a single string that is returned, similar to
> what you proposed for handling multiple xattrs with inode_getsecctx()?
>
If we want to use secctx consistently within the kernel, and
I personally think that is a good idea, I would have to chose
the SMACK64IPIN (label checked on packet delivery) value. Putting
both the SMACK64IPOUT and SMACK64IPIN "contexts" into the secctx
would violate the architectural notion that a secctx is the
textual representation of a value used to make access control
decisions. It would mean that calling security_secctx_to_secid()
with the value returned by security_sk_getsecctx would be invalid.
Note that this is different from the mechanism I had suggested
for handling secctx in the multiple LSM case, as the composed
string would map to a single secid which would in turn map back
to that same composed string. If, on the other hand, what netstat -Z
is out to show is all of the LSM base information about the socket
a compound string might make sense, it just would not be a
secctx, it would be an informational string of some other flavor.
next prev parent reply other threads:[~2011-08-31 20:49 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-31 8:36 [PATCH 0/2] Dump the sock's security context rongqing.li
2011-08-31 8:36 ` [PATCH 1/2] Define security_sk_getsecctx rongqing.li
2011-08-31 15:43 ` Casey Schaufler
2011-08-31 18:46 ` Stephen Smalley
2011-08-31 20:49 ` Casey Schaufler [this message]
2011-08-31 8:36 ` [PATCH 2/2] Add a netlink attribute INET_DIAG_SECCTX rongqing.li
2011-08-31 12:08 ` Stephen Smalley
2011-08-31 21:18 ` Paul Moore
2011-09-01 9:33 ` Rongqing Li
2011-09-01 12:28 ` Paul Moore
2011-09-05 0:32 ` Rongqing Li
2011-08-31 8:38 ` [PATCH 0/2] Dump the sock's security context Rongqing Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4E5E9E75.8050305@schaufler-ca.com \
--to=casey@schaufler-ca$(echo .)com \
--cc=linux-security-module@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=rongqing.li@windriver$(echo .)com \
--cc=sds@tycho$(echo .)nsa.gov \
--cc=selinux@tycho$(echo .)nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox