On Thu, Jun 23, 2016 at 5:11 PM, Casey Schaufler <ca...@schaufler-ca.com> wrote: > Subject: [PATCH v4 3/3] LSM: Add context interface for proc attrs > > The /proc/.../attr/current interface is used by all three > Linux security modules (SELinux, Smack and AppArmor) to > report and modify the process security attribute. This is > all fine when there is exactly one of these modules active > and the userspace code knows which it module it is. > It would require a major change to the "current" interface > to provide information about more than one set of process > security attributes. Instead, a "context" attribute is > added, which identifies the security module that the > information applies to. The format is: > > lsmname='context-value' > > When multiple concurrent modules are supported the > /proc/.../attr/context interface will include the data > for all of the active modules. > > lsmname1='context-value1'lsmname2='context-value2' > > The module specific subdirectories under attr contain context > entries that report the information for that specific module > in the same format.
I think a delimiter between the different LSMs would be a good idea. A comma seems like a safe choice at the moment. -- paul moore www.paul-moore.com
