Messages in this thread | ![/](/images/icornerl.gif) | | Subject | Re: Time to remove LSM (was Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks) | From | Arjan van de Ven <> | Date | Mon, 24 Apr 2006 15:16:59 +0200 |
| |
On Mon, 2006-04-24 at 08:09 -0500, Serge E. Hallyn wrote: > Quoting Arjan van de Ven (arjan@infradead.org): > > for all such things in the first place. In fact, we already know that to > > do auditing, LSM is the wrong thing to do (and that's why audit doesn't > > use LSM). It's one of those fundamental linux truths: Trying to be > > As I recall it was simply decided that LSM must be "access control > only", and that was why it wasn't used for audit.
no you recall incorrectly. Audit needs to audit things that didn't work out, like filenames that don't exist. Audit needs to know what is going to happen before the entire "is this allowed" chain is going to be followed. SELInux and other LSM parts are just one part of that chain, and there's zero guarantee that you get to the LSM part in the chain..... Now of course you could add hooks at places where audit puts them now, and call those "LSM" but that'd just be artificial, pointless and bad design.
> Didn't Linda Walsh claim a much faster audit implementation using LSM > than the current lightweight audit framework?
People can claim the world; the problem is that you can't make a tight audit with LSM because of all the namespace issues (AppArmor can evade those by locking stuff down, audit obviously cannot). So I highly doubt the validity of such claim. Audit also HAS to tie into some other places to avoid having to double-copy on the userspace filename data, at which point you're not really using LSM, you're just hijacking some of it's hooks. [and you have to avoid such double copy for your audit to be reliable enough to mean something]
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| ![\](/images/icornerr.gif) |