[lkml]   [2003]   [Feb]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: What went wrong with LSM, was: Re: [BK PATCH] LSM changes for 2.5.59
    'Christoph Hellwig' wrote:

    >On Wed, Feb 12, 2003 at 02:22:34PM -0800, Crispin Cowan wrote:
    >>LSM does have an abstract design: it mediates
    >>access to major internal kernel objects (processes, inodes, etc.) by
    >>user-space processes, throwing access requests out to the LSM module.
    >We seem to use the term design differently. And maybe my english
    >wording wasn't perfect (I'm no native speaker..). My objection is that
    >LSM by itself does not enforce the tightest bit of security policy
    >design. Your "design" is putting in hooks before object accesses
    >without making them tied to enforcing some security policy.
    You're right, we're using English differently :-) I don't know what the
    above paragraph means. I can guess, but that's where the trouble is
    coming from. Based on the guessing:

    * Yes, LSM by itself does not enforce security policy.
    * Yes, the desing is to put hooks in front of important objects, and
    ask the modules if that access is ok.

    The effect of this is to push security policy out to the modules. This
    is what Linus asked for, so that he would not have to maintain security
    policy or security policy engines.

    >When reading this thread some people (e.g. David [*]) still seem that
    >changes should be done for LSM's sake - but that's entirely wrong.
    >The point of getting LSM or something similar in is for the sake
    >of the _linux_ _kernel_ getting usefull features, not for enabling
    >some small community writing out of tree modules.
    You have often made this point about "for the Linux kernel's sake" vs.
    some other motivation, and it bothers me. It suggests that you somehow
    care about the Linux kernel more than I do. No, I care about the Linux
    kernel a lot. More over, I don't see how "who cares about the kernel
    more" is pertinent.

    That aside, the Linux kernel per se is not some entity to be pleased
    like a stone god. Linux exists for its users. LSM is designed to benefit
    Linux kernel users. Some benefit by being able to add security features
    that they could not get before, because they are not capable of patching
    their own kernels. Some benefit by being able to produce experimental
    security modules without having to patch & track the Linux kernel. Some
    benefit by being able to unload security stuff and go for a leaner

    LSM is not about pleasing a small number of module vendors. It is about
    benefiting a large number of potential users.


    Crispin Cowan, Ph.D.
    Chief Scientist, WireX
    Security Hardened Linux Distribution:
    Available for purchase:
    Just say ".Nyet"

    [unhandled content-type:application/pgp-signature]
     \ /
      Last update: 2005-03-22 13:33    [W:0.022 / U:1.936 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site