Messages in this thread | | | Date | Tue, 05 Aug 2008 20:00:31 -0700 | From | Casey Schaufler <> | Subject | Re: [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning |
| |
Paul Moore wrote: > On Monday 04 August 2008 11:44:28 pm Casey Schaufler wrote: > >> Cliffe wrote: >> >>> Other security schemes such as intrusion detection, >>> firewalls/netfilter, anti-malware, and application restrictions >>> (sandboxes such as jails or finer grained restrictions such as >>> AppArmor) could all register LSMs onto the stack. >>> >> Stacking is easy for files. It's a real pain in the backside for UDP >> packets. >> > > How is it any better/worse for UDP packets than files? > On delivery you'd need to decide what security scheme is actually available on the packet and in what order to interpret any inbound security data. If you had an MLS scheme that uses CIPSO, an integrity mechanism using IPSEC and a DAC scheme that assigns user ids by host address getting the ordering right and every domain registered properly in the networking stack would be a trick. Plus, making sure that any state the security scheme requires is tricky. Maybe it's not actually worse if the schemes agree on what qualifies as a security element, but if one scheme does access control outbound while another does inbound it will get hairy.
| |