LSM-neutral Audit (SELinux audit separation)
Get series with b4
b4 am 20080301194752.GA19636@ubuntuVersions newest first · linked by author and title
- v2 Latest9 patches 21 repliesIn review
- v14 patches 6 repliesSuperseded
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/9 | LSM: Introduce inode_getsecid and ipc_getsecid hooksinclude/ security/ security/ | +54 | 2 replies | |
| 2/9 | SELinux: setup new inode/ipc getsecid hookssecurity/ | +17 | 2 replies | |
| 3/9 | Audit: use new LSM hooks instead of SELinux exportskernel/ kernel/ kernel/ | +43 | 2 replies | |
| 4/9 | Netlink: Use generic LSM hooknet/ | +1 | 3 replies | |
| 5/9 | SELinux: remove redundant exportsinclude/ security/ | +0 | 2 replies | |
| 6/9 | LSM/Audit: Introduce generic Audit LSM hooksinclude/ security/ security/ | +127 | 2 replies | |
| 7/9 | Audit: internally use the new LSM audit hookskernel/ kernel/ kernel/ | +22 | 5 replies | |
| 8/9 | SELinux: use new audit hooks, remove redundant exportsinclude/ include/ kernel/ +3 more | +136 | 1 reply | |
| 9/9 | Audit: Final renamings and cleanupinclude/ kernel/ kernel/ | +28 | 1 reply |
Reviews trailers per patch
All 9 patches have a Reviewed-by or Acked-by.
| Patch | James Morris | David S. Miller | Paul Moore |
|---|---|---|---|
| 1/9 | A-b | R-b | |
| 2/9 | A-b | R-b | |
| 3/9 | A-b | R-b | |
| 4/9 | A-b | A-b | R-b |
| 5/9 | A-b | R-b | |
| 6/9 | A-b | R-b | |
| 7/9 | A-b | ||
| 8/9 | A-b | ||
| 9/9 | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.
Cover letter [PATCH-v2 -mm 0/9] LSM-neutral Audit (SELinux audit separation)
Hi everybody,
A series of 9 patches to let Audit be LSM netural. This is done for proper future audit<->SMACK integration which will also be useful for any future LSM.
Basically, patches add below new LSM hooks:
1- secid extraction:inode_getsecid(inode, secid)ipc_getsecid(ipcp, secid)
2- LSM-specific Audit rules manipulation:audit_rule_init(field, op, rulestr, lsmrule)audit_rule_known(krule)audit_rule_match(secid, field, op, rule, actx)audit_rule_free(rule)
and remove ,now redundant, equivalent SELinux exported interfaces.
Initial work and idea by: Casey Schaufler <[email protected]> Thanks to Paul Moore <[email protected]> for his deep review of first version.
include/linux/audit.h | 29 ++++++++ include/linux/security.h | 102 +++++++++++++++++++++++++++++ include/linux/selinux.h | 134 --------------------------------------- kernel/audit.c | 24 ++---- kernel/audit.h | 25 ------- kernel/auditfilter.c | 99 ++++++++++------------------ kernel/auditsc.c | 74 +++++++++++---------- net/netlink/af_netlink.c | 3 +- security/dummy.c | 47 +++++++++++++ security/security.c | 35 ++++++++++ security/selinux/exports.c | 42 ------------ security/selinux/hooks.c | 27 +++++++ security/selinux/include/audit.h | 65 ++++++++++++++++++ security/selinux/ss/services.c | 45 +++++++++---- 14 files changed, 420 insertions(+), 331 deletions(-)
Regards,
Signature · 5 lines
"Better to light a candle, than curse the darkness" Ahmed S. Darwish Homepage: http://darwish.07.googlepages.com Blog: http://darwish-07.blogspot.com