On Tue, Apr 11, 2017 at 6:43 AM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > On Mon, Apr 10, 2017 at 1:00 PM, Djalal Harouni <tixxdz@xxxxxxxxx> wrote: >> On Mon, Apr 10, 2017 at 9:26 PM, Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: >>> I think that would be the prudent approach. There is still >>> the possibility that blob sharing (or full stacking, if you >>> prefer) won't be accepted any time soon. >> >> Ok Casey! I will wait for more feedback, and if other maintainers do >> not object, I will convert it back to rhashtables in next iterations >> making sure that it should be simple to convert later to a blob >> sharing mechanism. > > Would it be possible just to add a single field to task_struct if this > LSM is built in? I feel like rhashtables is a huge overhead when a > single field is all that's needed. Well, yes rhashtables can have an overhead especially when reclaiming memory back, I could not identify a way how to separate tables unless we use cgroups as an ID. Anyway this of course could be added in task_struct and updated to work like the capability security hooks rather than a proper LSM with its own name. But as noted in the other response, we may need task->security field for Yama anyway. I'm open to suggestion ? I may try to converge the task->security blob with what Casey is proposing and see! otherwise fallback to task_struct as a last resort! Thanks! -- tixxdz -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
