[lkml]   [2009]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [TOMOYO 1/2] tomoyo: add Documentation/tomoyo.txt
    > +
    > +We believe that inode based security and name based security are complementary
    > +and both should be used together. But unfortunately, so far, we cannot enable
    > +multiple LSM modules at the same time. We feel sorry that you have to give up
    > +SELinux/SMACK/AppArmor etc. when you want to use TOMOYO.
    > +
    > +We hope that LSM becomes stackable in future. Meanwhile, you can use non-LSM
    > +version of TOMOYO, available at .
    > +LSM version of TOMOYO is a subset of non-LSM version of TOMOYO. We are planning
    > +to port non-LSM version's functionalities to LSM versions.
    If you go back through the mailing list you will find stackable has
    been debated at length many times.

    AppArmor and Tomoyo are both name based. So unlikely you would want
    both at the same time.

    LSM exists mostly because designers of security systems could not
    decide on the 1 default Linux should have.

    For inode and name based security the question should be can Tomoyo
    merge with the other LSM modules in away that avoids stacking.

    Smack and Selinux are sharing code in places with each other. Really
    there are only 3 currently active developed LSM's Smack Selinux and
    Tomoyo. Merge could basically get us down to 1 with 3 different
    configure processing engines. I have not seen apparmor patches that
    bring it up to using the secure way of doing name based secuirty.
    Could have missed it.

    Smack and Selinux both have not contained name based because there was
    no secure way todo it. Due to Tomoyo teams work that has changed. So
    both Smack and Selinux really need to look at there position on
    supporting name based. I agree it would be a gain of Smack and
    Selinux supported name based.

    Major reason for not allowing multi-able LSM's is the risk that one
    might interfere incorrectly with the others operation. This is why
    merging is fine. Since the new method would have to be integrated at
    development time into 1 LSM so there could not be conflits.

    Peter Dolding

     \ /
      Last update: 2009-04-10 14:29    [from the cache]
    ©2003-2014 Jasper Spaans. hosted at Digital Ocean