TOMOYO Linux - MAC based on process invocation history.
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest21 patches 3 repliesIn review
Changes since previous (November 17th) submission from the cover letter
* Added security goal document. (Documentation/TOMOYO.txt) This document is intended to specify the security goal that TOMOYO Linux is trying to achieve. Thread URL:
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/21 | TOMOYO Linux documentation.Documentation/ | +266 | 0 replies | |
| 2/21 | Add struct vfsmount to struct task_struct.include/ include/ | +3 | 2 replies | |
| 3/21 | Add wrapper functions for VFS helper functions.include/ | +138 | 0 replies | |
| 4/21 | Replace VFS with wrapper functions.fs/ fs/ net/ | +34 | 0 replies | |
| 5/21 | Add packet filtering based on processs security context.include/ net/ net/ +2 more | +80 | 0 replies | |
| 6/21 | Data structures and prototype defitions.security/ security/ | +740 | 0 replies | |
| 7/21 | Memory and pathname management functions.security/ | +659 | 0 replies | |
| 8/21 | Utility functions and policy manipulation interface.security/ | +2450 | 0 replies | |
| 9/21 | Domain transition functions.security/ | +1261 | 0 replies | |
| 10/21 | Auditing interface.security/ | +239 | 0 replies | |
| 11/21 | File access control functions.security/ | +1468 | 0 replies | |
| 12/21 | argv0 check functions.security/ | +215 | 0 replies | |
| 13/21 | environment variable name check functions.security/ | +274 | 0 replies | |
| 14/21 | Network access control functions.security/ | +934 | 0 replies | |
| 15/21 | Namespace manipulation control functions.security/ | +908 | 0 replies | |
| 16/21 | Signal control functions.security/ | +226 | 0 replies | |
| 17/21 | Capability access control functions.security/ | +320 | 0 replies | |
| 18/21 | LSM adapter functions.security/ | +825 | 0 replies | |
| 19/21 | Conditional permission support.security/ | +684 | 0 replies | |
| 20/21 | Kconfig and Makefilesecurity/ security/ security/ +1 more | +30 | 0 replies | |
| 21/21 | Add signal hooks at sleepable location.include/ kernel/ security/ +1 more | +91 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [TOMOYO #6 00/21] TOMOYO Linux - MAC based on process invocation history.
"TOMOYO Linux" is our work in the field of security enhancement for Linux. This is the 6th submission of TOMOYO Linux.
(http://tomoyo.sourceforge.jp/wiki-e/?WhatIs#mainlining)
Changes since previous (November 17th) submission:
* Added security goal document. (Documentation/TOMOYO.txt) This document is intended to specify the security goal that TOMOYO Linux is trying to achieve. Thread URL:
http://lkml.org/lkml/2007/12/25/18
* Added environment variable name control functionality. Users can restrict the environment variable's names passed to execve() for each domain.
* Refreshed patches for the latest -mm tree.
Patches are for 2.6.24-rc6-mm1
The possibility of AB-BA deadlock has been pointed out and argued in
http://lkml.org/lkml/2007/11/5/388 .
We believe that LSM functions shouldn't access namespace_sem, so
we chose to write a set of wrapper functions to pass "struct vfsmount" to LSM functions using "struct task_struct". This method is suggested at
http://www.mail-archive.com/[email protected]/msg01712.html .
We wish Linux to merge either AppArmor's "Pass struct vfsmount to ..." patches or our patches marked as [02/21], [03/21], [04/21] into mainline kernel so that AppArmor and TOMOYO Linux can safely access "struct vfsmount" from LSM.
Patches consist of five types.
* [TOMOYO 01/21]: Documentation.
* [TOMOYO 02-05/21]: Essential modifications against -mm kernel.
* [TOMOYO 06-19/21]: LSM implementation of TOMOYO Linux.
* [TOMOYO 20/21]: Makefile and Kconfig.
* [TOMOYO 21/21]: Optional modifications against -mm kernel.
We are trying to make a fair ��secure Linux�� comparison table, it should explain the differences between TOMOYO Linux and AppArmor.
(http://tomoyo.sourceforge.jp/wiki-e/?WhatIs#comparison)
We would like TOMOYO Linux to be added into -mm tree so that more people can try. Any kind of feedbacks for the patches and the table would be appreciated.