Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751689AbdFFLmf (ORCPT ); Tue, 6 Jun 2017 07:42:35 -0400 Received: from www262.sakura.ne.jp ([202.181.97.72]:62887 "EHLO www262.sakura.ne.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751389AbdFFLme (ORCPT ); Tue, 6 Jun 2017 07:42:34 -0400 To: igor.stoppa@huawei.com, casey@schaufler-ca.com, keescook@chromium.org, mhocko@kernel.org, jmorris@namei.org Cc: paul@paul-moore.com, sds@tycho.nsa.gov, hch@infradead.org, labbott@redhat.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: Re: [PATCH 4/5] Make LSM Writable Hooks a command line option From: Tetsuo Handa References: <71e91de0-7d91-79f4-67f0-be0afb33583c@schaufler-ca.com> <201706060550.HAC69712.OVFOtSFLQJOMFH@I-love.SAKURA.ne.jp> <201706061954.GBH56755.QSOOFMFLtJFVOH@I-love.SAKURA.ne.jp> <6c807793-6a39-82ef-93d9-29ad2546fc4c@huawei.com> In-Reply-To: <6c807793-6a39-82ef-93d9-29ad2546fc4c@huawei.com> Message-Id: <201706062042.GAC86916.FMtHOOFJOSVLFQ@I-love.SAKURA.ne.jp> X-Mailer: Winbiff [Version 2.51 PL2] X-Accept-Language: ja,en,zh Date: Tue, 6 Jun 2017 20:42:31 +0900 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 459 Lines: 11 Igor Stoppa wrote: > Who decides when enough is enough, meaning that all the needed modules > are loaded? > Should I provide an interface to user-space? A sysfs entry? No such interface is needed. Just an API for applying set_memory_rw() and set_memory_ro() on LSM hooks is enough. security_add_hooks() can call set_memory_rw() before adding hooks and call set_memory_ro() after adding hooks. Ditto for security_delete_hooks() for SELinux's unregistration.