Messages in this thread | | | Date | Wed, 15 Jun 2005 15:00:32 -0700 (PDT) | From | Casey Schaufler <> | Subject | Re: [PATCH] 3 of 5 IMA: LSM-based measurement code |
| |
--- serue@us.ibm.com wrote:
> Ok, so to be clear, any module which does not > directly impose some form > of access control is not eligible for an LSM?
In particular, an additional access control. LSM is not for changing the existing policy, it is for imposing additional policy.
You could, of course, add code to act on the integrity measurements you've made, in which case you could be in conformance with the stated eligibilty requirements.
> (in that case that clearly settles the issue)
It sure took the wind out of the sails for the SGI audit implementation.
Casey Schaufler casey@schaufler-ca.com
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |