[Patch v4 13/18] security: Update security level of a process when modifying its dumpability

[Schaufler, Casey]

> -----Original Message-----
> From: Tim Chen [mailto:tim.c.chen at linux.intel.com]
> Sent: Tuesday, October 30, 2018 2:31 PM
> To: Schaufler, Casey <casey.schaufler at intel.com>; Jiri Kosina
> <jikos at kernel.org>; Thomas Gleixner <tglx at linutronix.de>
> Cc: Tom Lendacky <thomas.lendacky at amd.com>; Ingo Molnar
> <mingo at redhat.com>; Peter Zijlstra <peterz at infradead.org>; Josh Poimboeuf
> <jpoimboe at redhat.com>; Andrea Arcangeli <aarcange at redhat.com>; David
> Woodhouse <dwmw at amazon.co.uk>; Andi Kleen <ak at linux.intel.com>;
> Hansen, Dave <dave.hansen at intel.com>; Mallick, Asit K
> <asit.k.mallick at intel.com>; Arjan van de Ven <arjan at linux.intel.com>; Jon
> Masters <jcm at redhat.com>; Waiman Long <longman9394 at gmail.com>;
> linux-kernel at vger.kernel.org; x86 at kernel.org; linux-security-module <linux-
> security-module at vger.kernel.org>
> Subject: Re: [Patch v4 13/18] security: Update security level of a process when
> modifying its dumpability
> 
> On 10/30/2018 01:57 PM, Schaufler, Casey wrote:
> 
> >
> > This isn't an LSM hook and hence does not belong in this file.
> > arch_set_security() isn't descriptive, and is in fact a bad choice
> > as task_struct has a field "security". This function has nothing
> > to do with the task->security field, which is what I would expect
> > based on the name.
> >
> 
> What file will be a logical place for this function?

kernel/cpu.c ? You're working with CPU localized mitigations, right?

You don't want it under security/ as that's all supposed to
be bits of the LSM infrastructure.

> >> +
> >> +int update_process_security(struct task_struct *task)
> >
> > Again, this isn't an LSM hook and does not belong in this file.
> > Also again, "security" isn't descriptive in the name.
> >
> 
> Thanks.
> 
> Tim