Messages in this thread | | | Date | Mon, 9 Sep 2013 16:34:07 -0700 | Subject | Re: [PATCH 00/12] One more attempt at useful kernel lockdown | From | Kees Cook <> |
| |
On Mon, Sep 9, 2013 at 4:30 PM, James Bottomley <James.Bottomley@hansenpartnership.com> wrote: > On Mon, 2013-09-09 at 16:20 -0700, Kees Cook wrote: >> On Mon, Sep 9, 2013 at 4:19 PM, David Lang <david@lang.hm> wrote: >> > And if SELinux can do the job, what is the reason for creating this new >> > option? >> >> Not everyone uses SELinux. :) Also, it's rarely controlled the things >> we want to control here. > > It comes on by default (or its equivalent: AppArmour) in almost every > shipping distro.
Right, if "LSM" was meant here, yeah, I do use an LSM. But they, as a class of security policy in the kernel, handle isolation of entirely different things. The goal of "no way to mess with ring-0" isn't really related to the goals of the LSM in general, or specific MACs in particular.
-Kees
-- Kees Cook Chrome OS Security
| |