[lkml]   [2007]   [Nov]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: + smack-version-11c-simplified-mandatory-access-control-kernel.patch added to -mm tree
    Hash: SHA1

    Casey Schaufler wrote:
    > In the end we can call it CAP_LATE_FOR_DINNER if that's the only way
    > I can move forward. CAP_MAC_OVERRIDE is the obvious partner to
    > CAP_DAC_OVERRIDE, so that's still my preference. CAP_SMACK_OVERRIDE
    > unnecessarily ties it to one LSM, and in spite of what some people
    > still seem to think, I see more LSMs in the pipeline.

    I'd personally not like to see SMACK appear in a capability name. No
    offense Casey, but SMACK may be displaced with YAMAC (*) someday, and
    I'd hate to have wasted a capability on it. Using CAP_MAC_OVERRIDE makes
    sense to me - even if its not (yet/ever) honored by all MAC LSMs.

    I do have a question about whether one capability is sufficient in
    general for MAC. Looking at the:

    last draft, there are no less than 5 capabilities (p173) allocated for
    MAC. Presumably there was a good reason for 5 and not 1 back then -
    could you summarize what is different now?



    (*) yet-another example of yet-another

    Version: GnuPG v1.4.7 (Darwin)
    Comment: Using GnuPG with Mozilla -

    -----END PGP SIGNATURE-----
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-11-24 04:29    [W:0.021 / U:199.136 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site