lkml.org 
[lkml]   [2006]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC] Virtualization steps
    * Serge E. Hallyn (serue@us.ibm.com) wrote:
    > Quoting Chris Wright (chrisw@sous-sol.org):
    > > This is all fine. The question is whether this is a policy management
    > > issue or a kernel infrastructure issue. So far, it's not clear that this
    > > really necessitates kernel infrastructure changes to support container
    > > aware policies to be loaded by physical host admin/owner or the virtual
    > > host admin. The place where it breaks down is if each virtual host
    > > wants not only to control its own policy, but also its security model.
    >
    > What do you define as 'policy', and how is it different from the
    > security model?

    Model, as in TE, RBAC, or something trivially simple ala Openwall type
    protection. Policy, as in rules to drive the model.

    > Second, we might want container admins to insert LSMs.

    I think we can agree that this way lies madness.

    thanks,
    -chris
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-03-30 20:55    [W:4.165 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site