RE: [Patch v4 13/18] security: Update security level of a process when modifying its dumpability

[Schaufler, Casey]

> -----Original Message-----
> From: Tim Chen [mailto:tim.c.chen@xxxxxxxxxxxxxxx]
> Sent: Tuesday, October 30, 2018 2:31 PM
> To: Schaufler, Casey <casey.schaufler@xxxxxxxxx>; Jiri Kosina
> <jikos@xxxxxxxxxx>; Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Cc: Tom Lendacky <thomas.lendacky@xxxxxxx>; Ingo Molnar
> <mingo@xxxxxxxxxx>; Peter Zijlstra <peterz@xxxxxxxxxxxxx>; Josh Poimboeuf
> <jpoimboe@xxxxxxxxxx>; Andrea Arcangeli <aarcange@xxxxxxxxxx>; David
> Woodhouse <dwmw@xxxxxxxxxxxx>; Andi Kleen <ak@xxxxxxxxxxxxxxx>;
> Hansen, Dave <dave.hansen@xxxxxxxxx>; Mallick, Asit K
> <asit.k.mallick@xxxxxxxxx>; Arjan van de Ven <arjan@xxxxxxxxxxxxxxx>; Jon
> Masters <jcm@xxxxxxxxxx>; Waiman Long <longman9394@xxxxxxxxx>;
> linux-kernel@xxxxxxxxxxxxxxx; x86@xxxxxxxxxx; linux-security-module <linux-
> security-module@xxxxxxxxxxxxxxx>
> Subject: Re: [Patch v4 13/18] security: Update security level of a process when
> modifying its dumpability
> 
> On 10/30/2018 01:57 PM, Schaufler, Casey wrote:
> 
> >
> > This isn't an LSM hook and hence does not belong in this file.
> > arch_set_security() isn't descriptive, and is in fact a bad choice
> > as task_struct has a field "security". This function has nothing
> > to do with the task->security field, which is what I would expect
> > based on the name.
> >
> 
> What file will be a logical place for this function?

kernel/cpu.c ? You're working with CPU localized mitigations, right?

You don't want it under security/ as that's all supposed to
be bits of the LSM infrastructure.

> >> +
> >> +int update_process_security(struct task_struct *task)
> >
> > Again, this isn't an LSM hook and does not belong in this file.
> > Also again, "security" isn't descriptive in the name.
> >
> 
> Thanks.
> 
> Tim