[lkml]   [2005]   [Jun]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject[patch 0/12] lsm stacking v0.2: intro

    The set of patches to follow introduces support for stacking LSMs.
    This is its second posting to lkml. I am sending it out in the hopes of
    soliciting feedback and testing, with the obvious eventual goal of
    mainline adoption.

    The patches mainly do the following:

    1. Introduce the stacker LSM.
    2. Change the kernel object void * security fields to be hlists,
    and introduce an api for modules to share these.
    3. Modify SELinux to make use of stacker.
    4. Modify seclvl to use stacker.


    The purpose of these patches is to enable stacking multiple security
    modules. There are several cases where this would be very useful. It
    eases the testing of new modules with distro kernels, as it makes it
    possible to stack new modules with selinux and capabilities -- for
    instance if a user is running fedora. Second, it enables running
    selinux (or LIDS, etc) with integrity verification modules. (Digsig is
    an example of these, and within a few months hopefully the TPM-enabled
    slim+evm modules, which verifies integrity of file contents and extended
    attributes such as selinux contexts
    ( will be released
    for mainline inclusion). Thirdly, there are systems where running
    selinux is not practical for footprint reasons, and the security goals
    are easily expressed as a very small module. For instance, it might
    be desirable to confine a web browser on a zaurus, or to implement a
    site security policy on old hardware as per

    Performance impact of the actual stacker module is negligable. The
    security_{get,set,del,add}_value API does have a small performance
    impact. Please see
    if interested in the performance results. I am certainly interested in
    ways to further speed up security_get_value.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-06-30 21:46    [W:0.032 / U:23.436 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site