lkml.org 
[lkml]   [2008]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning
    Cliffe wrote:
    > If we had stackable LSMs then the required functionality could simply
    > be built into the LSM interface. Then the anti-malware would simply
    > stack itself with other LSMs. In my opinion this is a perfect example
    > for the argument of stackable LSMs.

    No argument from me.

    > So far we mainly have LSMs which provide an extra access control
    > mechanism (in addition to DAC).

    Yes. This is the design center for the LSM.

    > IMHO, Ideally DAC could be another stackable LSM (enabled by default).

    Yup. Search the archives for "authoritative hooks".

    > Other security schemes such as intrusion detection,
    > firewalls/netfilter, anti-malware, and application restrictions
    > (sandboxes such as jails or finer grained restrictions such as
    > AppArmor) could all register LSMs onto the stack.

    Stacking is easy for files. It's a real pain in the backside for UDP
    packets.

    > Additional infrastructure would be necessary. Permissible security
    > remains a item of contention. Perhaps I am naive but I think most LSMs
    > could work based on accept/reject. Where every LSM must accept an
    > action in order for it to be carried out.

    Please propose patches.

    > MHO,

    Oh, humility isn't all it's cracked up to be. Show us all up and
    write the code. I'm serious, I don't think there's anyone here who
    would object to a really good stacking scheme.



    \
     
     \ /
      Last update: 2008-08-05 05:47    [W:2.457 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site