'Christoph Hellwig' wrote:
>On Wed, Feb 12, 2003 at 02:22:34PM -0800, Crispin Cowan wrote:
>
>>LSM does have an abstract design: it mediates
>>access to major internal kernel objects (processes, inodes, etc.) by
>>user-space processes, throwing access requests out to the LSM module.
>>
>>
>We seem to use the term design differently. And maybe my english
>wording wasn't perfect (I'm no native speaker..). My objection is that
>LSM by itself does not enforce the tightest bit of security policy
>design. Your "design" is putting in hooks before object accesses
>without making them tied to enforcing some security policy.
>
You're right, we're using English differently :-) I don't know what the
above paragraph means. I can guess, but that's where the trouble is
coming from. Based on the guessing:
* Yes, LSM by itself does not enforce security policy.
* Yes, the desing is to put hooks in front of important objects, and
ask the modules if that access is ok.
The effect of this is to push security policy out to the modules. This
is what Linus asked for, so that he would not have to maintain security
policy or security policy engines.
>When reading this thread some people (e.g. David [*]) still seem that
>changes should be done for LSM's sake - but that's entirely wrong.
>The point of getting LSM or something similar in is for the sake
>of the _linux_ _kernel_ getting usefull features, not for enabling
>some small community writing out of tree modules.
>
You have often made this point about "for the Linux kernel's sake" vs.
some other motivation, and it bothers me. It suggests that you somehow
care about the Linux kernel more than I do. No, I care about the Linux
kernel a lot. More over, I don't see how "who cares about the kernel
more" is pertinent.
That aside, the Linux kernel per se is not some entity to be pleased
like a stone god. Linux exists for its users. LSM is designed to benefit
Linux kernel users. Some benefit by being able to add security features
that they could not get before, because they are not capable of patching
their own kernels. Some benefit by being able to produce experimental
security modules without having to patch & track the Linux kernel. Some
benefit by being able to unload security stuff and go for a leaner
configuration.
LSM is not about pleasing a small number of module vendors. It is about
benefiting a large number of potential users.
Crispin
-- Crispin Cowan, Ph.D. Chief Scientist, WireX http://wirex.com/~crispin/ Security Hardened Linux Distribution: http://immunix.org Available for purchase: http://wirex.com/Products/Immunix/purchase.html Just say ".Nyet"
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sat Feb 15 2003 - 22:00:46 EST