Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [GIT PULL] security: general updates for v4.21
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Casey Schaufler <casey@schaufler-ca.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        James Morris <jmorris@namei.org>
Cc:     Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
        linux-security-module@vger.kernel.org,
        Mimi Zohar <zohar@linux.vnet.ibm.com>,
        Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Date:   Sat, 29 Dec 2018 21:44:19 -0500
In-Reply-To: <45d180c5-a174-7eef-9e23-83b819f8abd6@schaufler-ca.com>
References: <alpine.LRH.2.21.1812250652420.2714@namei.org>
         <CAHk-=wiUaA4sZ=8UnT+q6eXE29K+XGVX=kZPR6gG-Z4UhO3p+Q@mail.gmail.com>
         <alpine.LRH.2.21.1812291406530.29722@namei.org>
         <CAHk-=wh4sL5mO1J+yzngonBvjO9ZwL_kA0a2e51rE9TzVjAA4g@mail.gmail.com>
         <alpine.LRH.2.21.1812291505480.31477@namei.org>
         <CAHk-=wh+6WrC_W7ZCjMDPaZm9SuuRjoTe8Buq123CfRvTyu0wA@mail.gmail.com>
         <45d180c5-a174-7eef-9e23-83b819f8abd6@schaufler-ca.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <1546137859.4069.59.camel@linux.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Sat, 2018-12-29 at 10:34 -0800, Casey Schaufler wrote:
> On 12/28/2018 8:15 PM, Linus Torvalds wrote:
> > On Fri, Dec 28, 2018 at 8:09 PM James Morris <jmorris@namei.org> wrote:
> >> Yep, I understand what you mean. I can't find the discussion from several
> >> years ago, but developers asked to be able to work with more current
> >> kernels, and I recall you saying that if you want to do this, merge to a
> >> specific -rc tag at least.
> > If people really want it, maybe the merge can state that explicit
> > thing, as it is I'm trying to push back on empty merges that don't
> > explain why they even exist.
> >
> >                   Linus
> 
> The security tree tends to get changed from multiple directions,
> most of which aren't based out of the security sub-system. The mount
> rework from David is an excellent example. It gets hit just about
> any time there's a significant VFS or networking change. Keeping
> it current has helped find issues much earlier in the process.

Agreed, the security subsystem is different than other subsystems.  In
addition to VFS changes, are key changes.  Changes in other subsystems
do affect the LSMs/integrity.

Included in this open window are a number of LSM changes, which were
not posted on the LSM mailing list and are not being upstreamed via
the LSMs.

Mimi