Re: [PATCH v3 15/15] selinux: delay sid population for rootfs till init is complete

2018-03-10 Thread Victor Kamensky
On Tue, 20 Feb 2018, Stephen Smalley wrote: On Fri, 2018-02-16 at 20:33 +, Taras Kondratiuk wrote: From: Victor Kamensky With initramfs cpio format that supports extended attributes we need to skip sid population on sys_lsetxattr call from initramfs for rootfs if security server is not

Re: [PATCH v3 14/15] selinux: allow setxattr on rootfs so initramfs code can set them

2018-03-10 Thread Victor Kamensky
On Tue, 20 Feb 2018, Stephen Smalley wrote: On Fri, 2018-02-16 at 20:33 +, Taras Kondratiuk wrote: From: Victor Kamensky initramfs code supporting extended cpio format have ability to fill extended attributes from cpio archive, but if SELinux enabled and security server is not

Re: [PATCH v3 15/15] selinux: delay sid population for rootfs till init is complete

2018-03-07 Thread Victor Kamensky
On Wed, 7 Mar 2018, Rob Landley wrote: On 02/20/2018 12:56 PM, Stephen Smalley wrote: On Fri, 2018-02-16 at 20:33 +, Taras Kondratiuk wrote: From: Victor Kamensky With initramfs cpio format that supports extended attributes we need to skip sid population on sys_lsetxattr call from

Re: [PATCH v3 01/15] Documentation: add newcx initramfs format description

2018-02-16 Thread Victor Kamensky
On Fri, 16 Feb 2018, Rob Landley wrote: On 02/16/2018 02:59 PM, H. Peter Anvin wrote: On 02/16/18 12:33, Taras Kondratiuk wrote: Many of the Linux security/integrity features are dependent on file metadata, stored as extended attributes (xattrs), for making decisions. These features need to

Re: [PATCH v2 01/15] Documentation: add newcx initramfs format description

2018-01-26 Thread Victor Kamensky
On Fri, 26 Jan 2018, Henrique de Moraes Holschuh wrote: On Thu, 25 Jan 2018, Rob Landley wrote: That said, I don't think -h newcx should emit (or recognize) the "TRAILER!!!1!" entry. That's kinda silly in-band signaling for 2018: files have a length, pipes provide EOF, and each cpiox entry st