Does anything need to be updated for the BPF LSM or does it auto-magically pick up new hooks? -------- Forwarded Message -------- References: <20230906102557.3432236-1-alpic@xxxxxxxxxx> <20231219090909.2827497-1-alpic@xxxxxxxxxx> In-Reply-To: <20231219090909.2827497-1-alpic@xxxxxxxxxx> From: Alfred Piccioni <alpic@xxxxxxxxxx> Date: Tue, 19 Dec 2023 10:10:38 +0100 Message-ID: <CALcwBGC9LzzdJeq3SWy9F3g5A32s5uSvJZae4j+rwNQqqLHCKg@xxxxxxxxxxxxxx> Subject: Re: [PATCH] security: new security_file_ioctl_compat() hook To: Paul Moore <paul@xxxxxxxxxxxxxx>, Stephen Smalley <stephen.smalley.work@xxxxxxxxx>, Eric Paris <eparis@xxxxxxxxxxxxxx> Cc: linux-security-module@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, selinux@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx Thanks for taking the time to review! Apologies for the number of small mistakes. > s/syscal/syscall/ > Might to consider checking using codespell to catch such things > although it is imperfect. Fixed, loaded codespell. > Paul doesn't like C++-style comments so rewrite using kernel coding > style for multi-line comments or drop. > I don't think kernel coding style strictly prohibits use for > single-line comments and it isn't detected by checkpatch.pl but he has > previously > raised this on other patches. I actually like the C++-style comments > for one-liners especially for comments at the end of a line of code > but Paul is the maintainer so he gets the final word. Changed to /**/ style comments. No particular preference on my side for comment structure, just used to C++/Java style. > Sorry, missed this the first time but cut-and-paste error above: > s/GETFLAGS/SETFLAGS/ Egads. Fixed. > Also, IIRC, Paul prefers putting a pair of parentheses after function > names to distinguish them, so in the subject line > and description it should be security_file_ioctl_compat() and > security_file_ioctl(), and you should put a patch version > in the [PATCH] prefix e.g. [PATCH v3] to make clear that it is a later > version, and usually one doesn't capitalize SELinux > or the leading verb in the subject line (just "selinux: introduce"). Changed title to lower-case, prefixed with security, changed slightly to fit in summary with new parentheses. Added [PATCH V3] to the subject. > Actually, since this spans more than just SELinux, the prefix likely > needs to reflect that (e.g. security: introduce ...) > and the patch should go to the linux-security-module mailing list too > and perhaps linux-fsdevel for the ioctl change. Added cc 'selinux@xxxxxxxxxxxxxxx' and cc 'linux-kernel@xxxxxxxxxxxxxxx'. Thanks! > I didn't do an audit but does anything need to be updated for the BPF > LSM or does it auto-magically pick up new hooks? I'm unsure. I looked through the BPF LSM and I can't see any way it's picking up the file_ioctl hook to begin with. It appears to me skimming through the code that it automagically picks it up, but I'm not willing to bet the kernel on it. Do you know who would be a good person to ask about this to make sure?
