[lkml]   [2004]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC] [PATCH] [0/6] LSM Stacking
On Thu, 4 Nov 2004, Chris Wright wrote:

> Understood, although I don't think you'll get SELinux folks to agree
> that it could be useful in conjuction with other modules like that.

SELinux folks have differing opinions. Security module stacking would
obviously be useful for research & development, but there is a question in
my mind of whether this is justification enough for the feature in a
mainline kernel.

If it turns out to be generally useful to stack some security modules,
then it might be better to incorporate their functionality into SELinux
(or some other single module) so that policy and configuration can be
managed and analyzed under one system.

Something to keep in mind is that SELinux is a generic access control
framework specifically designed to allow flexible composition of different
security models under a centralized security policy.

LSM is a useful framework for implementing different security _systems_,
but I don't think it's suitable for composition of security models.
That's what SELinux is for.

> The real bottom line is that it can't slow anything down for the single
> module case.


- James
James Morris

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:07    [W:0.063 / U:2.476 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site