Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-08 Thread Lakshmi Ramasubramanian
On 3/8/21 4:42 PM, Paul Moore wrote: On Fri, Mar 5, 2021 at 2:29 PM Lakshmi Ramasubramanian wrote: On 3/5/21 11:22 AM, Paul Moore wrote: Hi Paul, On Fri, Mar 5, 2021 at 12:57 PM James Bottomley wrote: On Fri, 2021-03-05 at 12:52 -0500, Paul Moore wrote: [...] This draft seems fine to me,

Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-08 Thread Paul Moore
On Fri, Mar 5, 2021 at 2:29 PM Lakshmi Ramasubramanian wrote: > On 3/5/21 11:22 AM, Paul Moore wrote: > > Hi Paul, > > > On Fri, Mar 5, 2021 at 12:57 PM James Bottomley > > wrote: > >> On Fri, 2021-03-05 at 12:52 -0500, Paul Moore wrote: > >> [...] > >>> This draft seems fine to me, but there is

Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-05 Thread Lakshmi Ramasubramanian
On 3/5/21 11:22 AM, Paul Moore wrote: Hi Paul, On Fri, Mar 5, 2021 at 12:57 PM James Bottomley wrote: On Fri, 2021-03-05 at 12:52 -0500, Paul Moore wrote: [...] This draft seems fine to me, but there is a small logistical blocker at the moment which means I can't merge this until -rc2 is rel

Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-05 Thread Paul Moore
On Fri, Mar 5, 2021 at 12:57 PM James Bottomley wrote: > On Fri, 2021-03-05 at 12:52 -0500, Paul Moore wrote: > [...] > > This draft seems fine to me, but there is a small logistical blocker > > at the moment which means I can't merge this until -rc2 is released, > > which likely means this coming

Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-05 Thread James Bottomley
On Fri, 2021-03-05 at 12:52 -0500, Paul Moore wrote: [...] > This draft seems fine to me, but there is a small logistical blocker > at the moment which means I can't merge this until -rc2 is released, > which likely means this coming Monday. The problem is that this > patch relies on code that wen

Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-05 Thread Paul Moore
On Fri, Feb 12, 2021 at 11:37 AM Lakshmi Ramasubramanian wrote: > > SELinux stores the configuration state and the policy capabilities > in kernel memory. Changes to this data at runtime would have an impact > on the security guarantees provided by SELinux. Measuring this data > through IMA subs

Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-04 Thread Lakshmi Ramasubramanian
On 3/4/21 5:45 PM, Paul Moore wrote: On Thu, Mar 4, 2021 at 2:20 PM Lakshmi Ramasubramanian wrote: On 2/12/21 8:37 AM, Lakshmi Ramasubramanian wrote: Hi Paul, SELinux stores the configuration state and the policy capabilities in kernel memory. Changes to this data at runtime would have an i

Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-04 Thread Paul Moore
On Thu, Mar 4, 2021 at 2:20 PM Lakshmi Ramasubramanian wrote: > On 2/12/21 8:37 AM, Lakshmi Ramasubramanian wrote: > > Hi Paul, > > > SELinux stores the configuration state and the policy capabilities > > in kernel memory. Changes to this data at runtime would have an impact > > on the security g

Re: [PATCH v3] selinux: measure state and policy capabilities

2021-03-04 Thread Lakshmi Ramasubramanian
On 2/12/21 8:37 AM, Lakshmi Ramasubramanian wrote: Hi Paul, SELinux stores the configuration state and the policy capabilities in kernel memory. Changes to this data at runtime would have an impact on the security guarantees provided by SELinux. Measuring this data through IMA subsystem provi

[PATCH v3] selinux: measure state and policy capabilities

2021-02-12 Thread Lakshmi Ramasubramanian
SELinux stores the configuration state and the policy capabilities in kernel memory. Changes to this data at runtime would have an impact on the security guarantees provided by SELinux. Measuring this data through IMA subsystem provides a tamper-resistant way for an attestation service to remotel