Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20200716174351.20128-1-nramas@linux.microsoft.com>
 <20200716174351.20128-5-nramas@linux.microsoft.com> <CAEjxPJ43eXK0xgrE=gDxZVg2SDTz4bkd7N4otjk-cvxf3fKL-g@mail.gmail.com>
 <9478ddca-8298-5170-836d-8cbc7a070df2@linux.microsoft.com>
In-Reply-To: <9478ddca-8298-5170-836d-8cbc7a070df2@linux.microsoft.com>
From:   Stephen Smalley <stephen.smalley.work@gmail.com>
Date:   Thu, 16 Jul 2020 15:45:51 -0400
Message-ID: <CAEjxPJ5p_T+C1NDz3iF7fvQzQAURpAcipvQfQXLZTfLP4Wiqbg@mail.gmail.com>
Subject: Re: [PATCH v2 4/5] LSM: Define SELinux function to measure security state
To:     Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Cc:     Mimi Zohar <zohar@linux.ibm.com>,
        Casey Schaufler <casey@schaufler-ca.com>,
        James Morris <jmorris@namei.org>,
        linux-integrity@vger.kernel.org,
        SElinux list <selinux@vger.kernel.org>,
        LSM List <linux-security-module@vger.kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Jul 16, 2020 at 3:13 PM Lakshmi Ramasubramanian
<nramas@linux.microsoft.com> wrote:
>
> On 7/16/20 11:54 AM, Stephen Smalley wrote:
> > Not sure about this error handling approach (silent, proceeding as if
> > the length was zero and then later failing with ENOMEM on every
> > attempt?). I'd be more inclined to panic/BUG here but I know Linus
> > doesn't like that.
> I am not sure if failing (kernel panic/BUG) to "measure" LSM data under
> memory pressure conditions is the right thing. But I am open to treating
> this error as a fatal error. Please let me know.

Let's at least log an error message since it otherwise silently
disables all measuring of security state.
Also not sure why we bother returning errors from
selinux_measure_data() since nothing appears to check or use the
result.
Don't know if integrity/IMA has any equivalent to the audit
subsystem's concept of audit_failure settings to control whether
errors that prevent auditing (measuring) are handled silently, with a
log message, or via a panic.  If not, I guess that can be explored
separately.