On 9/3/19 7:26 AM, Jarkko Sakkinen wrote: > Not having LSM hooks does not cause any risk to other parts of the > kernel as the device can still be controlled by using DAC permissions. > The hooks just provide more granularity than DAC in access decisions. Could we translate the security-speak to english, please? :) Is this it: LSMs can (try to) enforce things like "all executable code must be verified". The implementation in these patches has the potential to subvert policies like that since it has its own unique mechanisms for loading and mapping executable code. This will be fixed by future LSM enhancements on top of this set. For now, permissions on the SGX device file should be used to prevent untrusted users from using SGX to subvert LSM policies. ?
