lkml.org 
[lkml]   [2010]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Preview of changes to the Security susbystem for 2.6.36
    On Mon, Aug 02, 2010 at 07:33:26PM +0200, Christian Stroetmann wrote:
    > structure of the other LSMs, especially if it becomes large and in
    > this way important to be followed by only growing it with
    > functionalities taken from other security packages. If you say that
    > the way of the Yama LSM is the right way to do it in general, then
    > we don't need a new LSM like Yama, but a new LSM architecture.

    Well, trying to get these protections into mainline does seem to be
    demonstrating a need for some kind of security architecture that isn't LSM.

    As for chaining, I was considering introducing basic "first non-zero return
    code wins" chain of LSMs, but the chain could include only up to 1 LSM that
    implements the proc attr hook (though the prctl handler isn't non-zero but
    rather non-ENOSYS).

    -Kees

    --
    Kees Cook
    Ubuntu Security Team


    \
     
     \ /
      Last update: 2010-08-03 19:11    [W:2.676 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site