Re: [PATCH] LSM: LoadPin for module and firmware loading restrictions

2015-07-27 Thread Kees Cook
On Mon, Jul 27, 2015 at 7:36 PM, James Morris wrote: > On Mon, 27 Jul 2015, Kees Cook wrote: > >> On Sun, Jul 26, 2015 at 9:26 PM, James Morris wrote: >> > On Thu, 23 Jul 2015, Kees Cook wrote: >> > >> >> + >> >> +/* >> >> + * Return an allocated string that has been escaped of special characters

Re: [PATCH] LSM: LoadPin for module and firmware loading restrictions

2015-07-27 Thread James Morris
On Mon, 27 Jul 2015, Kees Cook wrote: > On Sun, Jul 26, 2015 at 9:26 PM, James Morris wrote: > > On Thu, 23 Jul 2015, Kees Cook wrote: > > > >> + > >> +/* > >> + * Return an allocated string that has been escaped of special characters > >> + * and double quotes, making it safe to log in quotes. >

Re: [PATCH] LSM: LoadPin for module and firmware loading restrictions

2015-07-27 Thread Kees Cook
On Sun, Jul 26, 2015 at 9:26 PM, James Morris wrote: > On Thu, 23 Jul 2015, Kees Cook wrote: > >> + >> +/* >> + * Return an allocated string that has been escaped of special characters >> + * and double quotes, making it safe to log in quotes. >> + */ >> +static char *kstrdup_quotable(char *src) >

Re: [PATCH] LSM: LoadPin for module and firmware loading restrictions

2015-07-26 Thread James Morris
On Thu, 23 Jul 2015, Kees Cook wrote: > + > +/* > + * Return an allocated string that has been escaped of special characters > + * and double quotes, making it safe to log in quotes. > + */ > +static char *kstrdup_quotable(char *src) > +{ Do you think these should go into a library? -- James

[PATCH] LSM: LoadPin for module and firmware loading restrictions

2015-07-23 Thread Kees Cook
This LSM enforces that kernel-loaded modules and firmware must all come from the same filesystem, with the expectation that such a filesystem is backed by a read-only device such as dm-verity or CDROM. This allows systems that have a verified and/or unchangeable filesystem to enforce module and fir