Re: [PATCH] LSM: allow an LSM to disable all hooks at once

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

To: Paul Moore <paul@xxxxxxxxxxxxxx>
Subject: Re: [PATCH] LSM: allow an LSM to disable all hooks at once
From: James Morris <jmorris@xxxxxxxxx>
Date: Tue, 17 Dec 2019 05:55:53 +1100 (AEDT)
Cc: Ondrej Mosnacek <omosnace@xxxxxxxxxx>, Stephen Smalley <sds@xxxxxxxxxxxxx>, Casey Schaufler <casey@xxxxxxxxxxxxxxxx>, Kees Cook <keescook@xxxxxxxxxxxx>, Linux Security Module list <linux-security-module@xxxxxxxxxxxxxxx>, "Serge E. Hallyn" <serge@xxxxxxxxxx>, SElinux list <selinux@xxxxxxxxxxxxxxx>, John Johansen <john.johansen@xxxxxxxxxxxxx>, Micah Morton <mortonm@xxxxxxxxxxxx>, Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
In-reply-to: <CAHC9VhRwPpBAD3vDwTf1q25Qhp-nE_wmPpqdyfsDwpUNS6smrw@mail.gmail.com>
References: <20191211140833.939845-1-omosnace@redhat.com> <677be2d4-8247-3c2b-ac13-def725cffaeb@tycho.nsa.gov> <201912110840.62A4E64BA@keescook> <356c555a-d4ab-84fb-0165-f7672bc1ee63@schaufler-ca.com> <2fdb09e7-6668-cb1b-8a2d-1550278ae803@tycho.nsa.gov> <CAFqZXNtjELoG_5GK5c4XpH8Be3NfsKMZdZvrJKPpnTLPKKgZ9A@mail.gmail.com> <1f613260-d315-6925-d069-e92b872b8610@tycho.nsa.gov> <CAHC9VhT_CBQN+aFWjpPixi9Ok3Z7bQ-053AHg4pvqVtn-RdVVA@mail.gmail.com> <0f0778af-73c2-3c75-30c0-da5eae203032@tycho.nsa.gov> <CAHC9VhT24b6YYTcE-h9pS9HnJ35unW_14EYLcNBBd-xUa=1L9A@mail.gmail.com> <83d047ce-0ca0-4152-1da7-32798c500aab@tycho.nsa.gov> <CAHC9VhQG9zZEL53XRdLHdmFJDpg8qAd9p61Xkm5AdSgM=-5eAg@mail.gmail.com> <83af5f0f-d3ec-7827-92e5-2db0997b9d22@tycho.nsa.gov> <CAHC9VhSqNGxqGQU6QfB3SxHZZdtPh79-4vOrpDXLr9zxT_X4bg@mail.gmail.com> <CAFqZXNv7PUgrU9Qe28e3cHnRAwjKZLVmNrOZggvkE5AB7T9o1Q@mail.gmail.com> <CAHC9VhRwPpBAD3vDwTf1q25Qhp-nE_wmPpqdyfsDwpUNS6smrw@mail.gmail.com>
User-agent: Alpine 2.21 (LRH 202 2017-01-01)

On Fri, 13 Dec 2019, Paul Moore wrote:

> Next week I think I'm going to put together a RFC patch that marks
> CONFIG_SECURITY_SELINUX_DISABLE as deprecated, and displays a warning
> when it is used at runtime.  Later on when we have a better idea of
> the removal date, we can start adding delays when it is used to help
> get people to migrate to the cmdline approach.

+1

-- 
James Morris
<jmorris@xxxxxxxxx>

References:
- [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Ondrej Mosnacek
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Stephen Smalley
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Kees Cook
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Casey Schaufler
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Stephen Smalley
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Ondrej Mosnacek
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Stephen Smalley
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Paul Moore
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Stephen Smalley
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Paul Moore
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Stephen Smalley
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Paul Moore
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Stephen Smalley
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Paul Moore
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Ondrej Mosnacek
- Re: [PATCH] LSM: allow an LSM to disable all hooks at once
  - From: Paul Moore

Prev by Date: mcstrans doesn't translate for s0 level (thus, doesn't work in mcs policy)
Next by Date: [PATCH v3 0/7] Introduce CAP_SYS_PERFMON to secure system performance monitoring and observability
Previous by thread: Re: [PATCH] LSM: allow an LSM to disable all hooks at once
Next by thread: Re: [PATCH] LSM: allow an LSM to disable all hooks at once
Index(es):
- Date
- Thread

[Index of Archives] [Selinux Refpolicy] [Linux SGX] [Fedora Users] [Fedora Desktop] [Yosemite Photos] [Yosemite Camping] [Yosemite Campsites] [KDE Users] [Gnome Users]