Messages in this thread | ![/](/images/icornerl.gif) | | Date | Tue, 18 Apr 2006 16:09:18 -0700 | From | Crispin Cowan <> | Subject | Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks |
| |
James Morris wrote: > On Tue, 18 Apr 2006, Crispin Cowan wrote: > >> SELinux has NSA legacy, and that is reflected in their inode design: it >> is much better at protecting secrecy, which is the NSA's historic >> mission. >> > No. The inode design is simply correct. > "Correct" for what? inode access control is correct if data secrecy is your number one objective. It is not necessarily correct for other purposes.
> Consider the following: > > What if Unix DAC security was implemented via pathnames, using a > configuration file and regexp matching enginer in the kernel, invoked > during file access, rather than the existing scheme of checking inode > ownership and permission attributes? > What of it? That sounds very close to the AppArmor design, except for the "discretionary" part. Just what is wrong with it? If your main complaint is that you would miss having chmod and umask, then I agree: we are not proposing to remove classic DAC. So what's your point?
> SELinux labels objects directly because it's the right thing to do. > Security design by Wilford Brimley: emphatic assertion :)
AppArmor is a fully functional access control system that works on pathname-based access controls. I'm sorry if it violates your religion for it to exist and work. Claiming that pathname-based access control is "broken" or "wrong" is about as useful as standing at Kitty Hawk in 1903 exclaiming that heavier-than-air flight is impossible. You don't have to like it, but denying its existence is nonsense.
> To also clarify: the legacy of SELinux is in the decades of research > performed into providing more comprehensive security than the original > secrecy-oriented TCSEC schemes. And conflating a highly loaded term such > as "NSA's historic mission" with an implementation specific aspect of > SELinux is useless in a technical discussion and IMHO totally > inappropriate. > It is totally appropriate because it goes to the core reason for the design difference between AppArmor and SELinux. The NSA, and indeed all intelligence agencies, have secrecy as their #1 security need. inode labels is absolutely the right way to achieve that.
However, I assert (emphatically :) that the broader user community has integrity and availability as higher priorities than secrecy, and that pathname-based access control is a better way to achieve that. I want to offer Linux users the choice of pathname-based access control if they want it. Why do you want to prevent them from having that choice?
Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering, Novell http://novell.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| ![\](/images/icornerr.gif) |