[lkml]   [2006]   [Apr]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Time to remove LSM (was Re: [RESEND][RFC][PATCH 2/7] implementation of LSM hooks)

--- "Serge E. Hallyn" <> wrote:

> Ah yes. It needed to be authoritative. I did
> recall incorrectly.
> I suspect some would argue that you are right that
> LSM is broken, but
> only because it wasn't allowed to be authoritative.

As I said at the time, I am disappointed that
authoritative hooks lost out, but it was hardly
the end of the world, and all in all, the LSM
that won out was a good first shot.

And of course, SGI's intent at the time was to
use LSM for audit. The prevailing attitude of
the day was that Linux would Never Allow Audit,
and a general scheme looked to be our best bet.
After LSM rejected authoritative hooks we
rewrote audit to use the accepted hook and,
get this, the Powers above canceled the project
the week we were to check it in.

I am happy to see the linux-audit project, and
happy to see POSIX ACLs as well. With an
authoritative LSM those would have been rolled
in and not required special interfaces of their
own. Oh well.

> Of course that
> was to increase chances of LSM upstream inclusion.

This was indeed a primary argument against
authoritative hooks, but the potential for
protrietary binary modules loomed large as

> Sorry Casey and
> Linda,

Ack. That association was strictly corporate.
Please disregard.

> I bet that just makes it sting all the harder
> if LSM is now
> removed for not being sufficiently useful.

Eh, I've been right in the past and I've been
wrong in the past. I've had more code thrown out
of systems than a lot of you have ever written,
so an interface vector that's proven unpopular
isn't going to bring me down much.

Casey Schaufler
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2006-04-25 06:09    [W:0.226 / U:4.468 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site