On Tue, Nov 27, 2018 at 2:27 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote: > On Mon, Nov 26, 2018 at 3:26 PM Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: > > Hmmm... the "From: Kees..." in the body is missing. Are you using "git > send-email"? Not to mention that you are sending (only) to the old SELinux mailing list. The new list is at selinux@xxxxxxxxxxxxxxx, see: https://lore.kernel.org/selinux/8263f9fa-16f1-1d0a-e391-61d609e50d7d@xxxxxxxxxxxxx/ > > > > > This adds a flag for the current "major" LSMs to distinguish them when > > we have a universal method for ordering all LSMs. It's called "legacy" > > since the distinction of "major" will go away in the blob-sharing world. > > > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > > Reviewed-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx> > > Reviewed-by: John Johansen <john.johansen@xxxxxxxxxxxxx> > > --- > > include/linux/lsm_hooks.h | 3 +++ > > security/apparmor/lsm.c | 1 + > > security/selinux/hooks.c | 1 + > > security/smack/smack_lsm.c | 1 + > > security/tomoyo/tomoyo.c | 1 + > > 5 files changed, 7 insertions(+) > > > > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h > > index aaeb7fa24dc4..63c0e102de20 100644 > > --- a/include/linux/lsm_hooks.h > > +++ b/include/linux/lsm_hooks.h > > @@ -2039,8 +2039,11 @@ extern char *lsm_names; > > extern void security_add_hooks(struct security_hook_list *hooks, int count, > > char *lsm); > > > > +#define LSM_FLAG_LEGACY_MAJOR BIT(0) > > + > > struct lsm_info { > > const char *name; /* Required. */ > > + unsigned long flags; /* Optional: flags describing LSM */ > > int (*init)(void); /* Required. */ > > }; > > > > diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c > > index 42446a216f3b..2edd35ca5044 100644 > > --- a/security/apparmor/lsm.c > > +++ b/security/apparmor/lsm.c > > @@ -1728,5 +1728,6 @@ static int __init apparmor_init(void) > > > > DEFINE_LSM(apparmor) = { > > .name = "apparmor", > > + .flags = LSM_FLAG_LEGACY_MAJOR, > > .init = apparmor_init, > > }; > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > > index 7ce683259357..56c6f1849c80 100644 > > --- a/security/selinux/hooks.c > > +++ b/security/selinux/hooks.c > > @@ -7209,6 +7209,7 @@ void selinux_complete_init(void) > > all processes and objects when they are created. */ > > DEFINE_LSM(selinux) = { > > .name = "selinux", > > + .flags = LSM_FLAG_LEGACY_MAJOR, > > .init = selinux_init, > > }; > > > > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > > index 81fb4c1631e9..3639e55b1f4b 100644 > > --- a/security/smack/smack_lsm.c > > +++ b/security/smack/smack_lsm.c > > @@ -4891,5 +4891,6 @@ static __init int smack_init(void) > > */ > > DEFINE_LSM(smack) = { > > .name = "smack", > > + .flags = LSM_FLAG_LEGACY_MAJOR, > > .init = smack_init, > > }; > > diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c > > index 1b5b5097efd7..09f7af130d3a 100644 > > --- a/security/tomoyo/tomoyo.c > > +++ b/security/tomoyo/tomoyo.c > > @@ -552,5 +552,6 @@ static int __init tomoyo_init(void) > > > > DEFINE_LSM(tomoyo) = { > > .name = "tomoyo", > > + .flags = LSM_FLAG_LEGACY_MAJOR, > > .init = tomoyo_init, > > }; > > -- > > 2.14.5 > > > > > > > -- > Kees Cook > _______________________________________________ > Selinux mailing list > Selinux@xxxxxxxxxxxxx > To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. > To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx. -- Ondrej Mosnacek <omosnace at redhat dot com> Associate Software Engineer, Security Technologies Red Hat, Inc.
