Re: [PATCH V33 01/30] security: Support early LSMs

2019-06-21 Thread Matthew Garrett
On Thu, Jun 20, 2019 at 10:23 PM Andy Lutomirski wrote: > > On Thu, Jun 20, 2019 at 6:22 PM Matthew Garrett > wrote: > > > > The lockdown module is intended to allow for kernels to be locked down > > early in boot - sufficiently early that we don't have the ability to > > kmalloc() yet. Add

Re: [PATCH V33 01/30] security: Support early LSMs

2019-06-21 Thread Matthew Garrett
On Thu, Jun 20, 2019 at 8:22 PM Kees Cook wrote: > > On Thu, Jun 20, 2019 at 06:19:12PM -0700, Matthew Garrett wrote: > > The lockdown module is intended to allow for kernels to be locked down > > early in boot - sufficiently early that we don't have the ability to > > kmalloc() yet. Add support

Re: [PATCH V33 01/30] security: Support early LSMs

2019-06-20 Thread Andy Lutomirski
On Thu, Jun 20, 2019 at 6:22 PM Matthew Garrett wrote: > > The lockdown module is intended to allow for kernels to be locked down > early in boot - sufficiently early that we don't have the ability to > kmalloc() yet. Add support for early initialisation of some LSMs, and > then add them to the

Re: [PATCH V33 01/30] security: Support early LSMs

2019-06-20 Thread Kees Cook
On Thu, Jun 20, 2019 at 06:19:12PM -0700, Matthew Garrett wrote: > The lockdown module is intended to allow for kernels to be locked down > early in boot - sufficiently early that we don't have the ability to > kmalloc() yet. Add support for early initialisation of some LSMs, and > then add them

[PATCH V33 01/30] security: Support early LSMs

2019-06-20 Thread Matthew Garrett
The lockdown module is intended to allow for kernels to be locked down early in boot - sufficiently early that we don't have the ability to kmalloc() yet. Add support for early initialisation of some LSMs, and then add them to the list of names when we do full initialisation later. Signed-off-by: