Re: [PATCH v6 0/3] security: Yama LSM

From: Roland McGrath
Date: Fri Nov 18 2011 - 16:45:30 EST


> Do you have any objection to my LSM performing ptrace restrictions?
> It's entirely self-contained, and all the major upstream crash
> handlers are already using the prctl() interface it uses to declare
> ptrace attach relationships.

I don't have the context of what your LSM does. But other LSMs apply their
own rules in security_ptrace(). That's what the hook is for. I'm not sure
why we would object from the perspective of core ptrace functionality.
LSMs are LSMs. Their behavior is between you and your users, as far as I
am concerned. As experts on ptrace and aficionados of its users, we may
have thoughts on what constraints on ptrace users would find annoying.
But that doesn't mean we'd object per se to whatever bizarre constraints
users want to ask an LSM to put on them.


Thanks,
Roland
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/