Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <201902120021.x1C0LeYB051392@www262.sakura.ne.jp>
 <CAGXu5jJ86XosW71111EaaSKcVwzw+UYvi4j619KwoBn=DNwrNw@mail.gmail.com> <201902120059.x1C0xEbp071744@www262.sakura.ne.jp>
In-Reply-To: <201902120059.x1C0xEbp071744@www262.sakura.ne.jp>
From:   Kees Cook <keescook@chromium.org>
Date:   Tue, 12 Feb 2019 10:26:49 -0800
Message-ID: <CAGXu5jKH83LJxd=yHs3kAfnjVxX9wphpivwaKnqvByJHwoi4XQ@mail.gmail.com>
Subject: Re: [PATCH] LSM: Ignore "security=" when "lsm=" is specified
To:     Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc:     James Morris <jmorris@namei.org>,
        linux-security-module <linux-security-module@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Feb 11, 2019 at 4:59 PM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> Kees Cook wrote:
> > On Mon, Feb 11, 2019 at 4:21 PM Tetsuo Handa
> > <penguin-kernel@i-love.sakura.ne.jp> wrote:
> > >
> > > Kees Cook wrote:
> > > > To avoid potential confusion, explicitly ignore "security=" when "lsm=" is
> > > > used on the command line, and report that it is happening.
> > >
> > > To maintain the existing behavior of CONFIG_DEFAULT_SECURITY, I also suggest this change.
> > > This saves e.g. Ubuntu users who are using only AppArmor from explicitly specifying
> > > security=apparmor when they don't want to enable other LSM_FLAG_LEGACY_MAJOR modules.
> >
> > No, this completely disables the purpose of lsm=
> >
> > I don't understand the use-case you're concerned about?
>
> The purpose of lsm= remains.
>
> I worry that distro users who don't explicitly specify security= parameter
> suddenly find TOMOYO messages because TOMOYO is no longer exclusive.

What's wrong with that? TOMOYO will start, see there is no policy, and
not do anything else.

> There are two ways for avoiding it. One is to explicitly specify security=
> parameter. The other is to remove tomoyo from CONFIG_LSM. This change adds
> the third way; preserve current security= behavior until they start explicitly
> specifying lsm= parameter.

"security=" has been deprecated due to the many many threads about how
it won't work moving forward. Leaving the CONFIG settings confuses the
situation and needlessly drags out the transition for no real gain.

But yes, if someone selects a "legacy major" LSM, the others
(including TOMOYO) will be disabled, which matches the old behavior.
Also, yes, removing it from CONFIG_LSM works; this is up to the distro
to decide.

-- 
Kees Cook