Messages in this thread | | | Subject | Re: SE Linux as module? | From | Valdis.Kletnieks@vt ... | Date | Mon, 11 Aug 2003 14:27:48 -0400 |
| |
On Mon, 11 Aug 2003 21:25:04 +0400, Andrey Borzenkov <arvidjaar@mail.ru> said: > config does not suggest building it as module. Is it not possible by design?
It wants to initialize itself as early as possible. If it's a module, then it can't get itself loaded until *after* userspace has already been started - at which point we have some unknown number of things already running that don't have any security context attached to them. Yes, you still need to load policy from userspace, but at least every process has been tagged with a "yes, we know about it". In addition, if you're loading from userspace, that's a whole additional set of attacks on it during the bot (for instance, keeping the insmod from running at all, inserting a trojaned module or policy, etc etc etc...)
[unhandled content-type:application/pgp-signature] | |