Re: [PATCH v2 4/5] LSM: Define SELinux function to measure security state

2020-07-16 Thread Lakshmi Ramasubramanian
On 7/16/20 12:45 PM, Stephen Smalley wrote: On Thu, Jul 16, 2020 at 3:13 PM Lakshmi Ramasubramanian wrote: On 7/16/20 11:54 AM, Stephen Smalley wrote: Not sure about this error handling approach (silent, proceeding as if the length was zero and then later failing with ENOMEM on every

Re: [PATCH v2 4/5] LSM: Define SELinux function to measure security state

2020-07-16 Thread Stephen Smalley
On Thu, Jul 16, 2020 at 3:13 PM Lakshmi Ramasubramanian wrote: > > On 7/16/20 11:54 AM, Stephen Smalley wrote: > > Not sure about this error handling approach (silent, proceeding as if > > the length was zero and then later failing with ENOMEM on every > > attempt?). I'd be more inclined to

Re: [PATCH v2 4/5] LSM: Define SELinux function to measure security state

2020-07-16 Thread Lakshmi Ramasubramanian
On 7/16/20 11:54 AM, Stephen Smalley wrote: The data for selinux-state in the above measurement is: enabled=1;enforcing=0;checkreqprot=1;network_peer_controls=1;open_perms=1;extended_socket_class=1;always_check_network=0;cgroup_seclabel=1;nnp_nosuid_transition=1;genfs_seclabel_symlinks=0; The

Re: [PATCH v2 4/5] LSM: Define SELinux function to measure security state

2020-07-16 Thread Stephen Smalley
On Thu, Jul 16, 2020 at 1:44 PM Lakshmi Ramasubramanian wrote: > > SELinux configuration and policy are some of the critical data for this > security module that needs to be measured. To enable this measurement > SELinux needs to implement the interface function, > security_measure_data(), that

[PATCH v2 4/5] LSM: Define SELinux function to measure security state

2020-07-16 Thread Lakshmi Ramasubramanian
SELinux configuration and policy are some of the critical data for this security module that needs to be measured. To enable this measurement SELinux needs to implement the interface function, security_measure_data(), that the LSM can call. Define the security_state() function in SELinux to