lkml.org 
[lkml]   [2007]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Linux Security *Module* Framework (Was: LSM conversion to static interface)
    Alan Cox wrote:
    >> The idea that poor security is worse than no security is fallacious,
    >> and not backed up by common experience.
    >>
    > There is a ton of evidence both in computing and outside of it which
    > shows that poor security can be very much worse than no security at all.
    > In particular stuff which makes users think they are secure but is
    > worthless is very dangerous indeed.
    >
    > When you know that security is limited you act appropriately, when you
    > believe security is good but it is not you take inappropriate risks and
    > get badly burned.
    >
    The "bad security is worse than no security" idea comes exactly from
    what Alan says above: it happens when the security is not as good as you
    think it is, and so you don't take adequate precautions.

    Using the ongoing bicycle lock example, the discovery a few years ago
    that a certain model of Kryptonite bike lock could be picked with a
    simple pen made the security on this otherwise very sturdy lock become
    abruptly very weak http://www.wired.com/culture/lifestyle/news/2004/09/64987

    Conversely, the case can also be made that "weak security is better than
    no security". It is better to secure your bike with a $10 lock than no
    lock. If someone insists on only "high" security bike locks that cost
    $1000 and weigh 30 lbs, then most people will choose to not lock their
    bikes, or skip biking all together.

    IMHO, much of the criticism leveled at proposed LSMs has been of the
    latter kind, or worse. That the security of the proposed LSM does not
    meet some particular use case does not make it "bad", it makes it not
    for that use case.

    To reject an LSM for providing "bad" security, IMHO you should have to
    show how it is possible to subvert the self-stated goals of that LSM.
    Complaints that the LSM fails to meet some goal outside of its stated
    purpose is irrelevant. Conjecture that it probably can be violated
    because of $contrivance is just so much FUD.

    Exception: it is valid to say that the self-stated goal is too narrow to
    be useful. But IMHO that bar of "too narrow" should be very, very low.
    Defenses against specific modes of attack would be a fine thing to build
    up in the library of LSMs, especially if we got a decent stacking module
    so that they could be composed.

    Crispin

    --
    Crispin Cowan, Ph.D. http://crispincowan.com/~crispin
    CEO, Mercenary Linux http://mercenarylinux.com/
    Itanium. Vista. GPLv3. Complexity at work

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-10-28 23:11    [W:0.028 / U:0.060 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site