lkml.org 
[lkml]   [2003]   [Aug]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: SE Linux as module?
From
Date
On Mon, 11 Aug 2003 21:25:04 +0400, Andrey Borzenkov <arvidjaar@mail.ru>  said:
> config does not suggest building it as module. Is it not possible by design?

It wants to initialize itself as early as possible. If it's a module, then it
can't get itself loaded until *after* userspace has already been started - at
which point we have some unknown number of things already running that don't
have any security context attached to them. Yes, you still need to load policy
from userspace, but at least every process has been tagged with a "yes, we know
about it". In addition, if you're loading from userspace, that's a whole
additional set of attacks on it during the bot (for instance, keeping the
insmod from running at all, inserting a trojaned module or policy, etc etc
etc...)

[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 13:47    [W:0.044 / U:0.244 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site