--=_courier-30108-1044848512-0001-2
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
LA Walsh wrote:
>>From: Crispin Cowan
>>
>>LSM does have a careful design.... meeting a
>>goal stated by Linus nearly two years ago.
>>
>>
> A security model that mediates access to security objects by
>logging all access and blocking access if logging cannot continue is
>unsupportable in any straight forward, efficient and/or non-kludgy, ugly
>way.
>
Because Linus asked for access control support, not audit logging
support, it is not surprising that logging models don't fit so well.
> Some security people were banned from the kernel
>devel. summit because their thoughts were deemed 'dangerous': fear was they
>were too persuasive about ideas that were deemed 'ignorant' and would
>fool those poor kernel lambs at the summit.
>
Internal SGI politics.
> Also unsupported: The "no-security" model -- where all security
>is thrown out (to save memory space and cycles) that was desired for embedded work.
>
False: capabilities is now a removable module, which is what Linus asked
for.
> LSM also doesn't support standard LSPP-B1 style graded security
>where mandatory access checks are logged as security violations before
>DAC checks are even looked at for an object.
>
Because doing so would have required approx. 6-10X as many LSM hooks as
the current LSM. Speak up if you think LSM should be 10X bigger to be
able to support Common Criteria standards compliant audit logging ...
> At one point a plan was proposed (by Casey Schaufler, SGI) and
>_\implemented\_ (team members & prjct lead Linda Walsh) to move all
>security checks out of the kernel into a 'default policy' module.
>The code to implement this was submitted to the LSM list in June 1991.
>
And I actually like that plan. But I still believe it to be too radical
for 2.6. It has many nice properties, but is much more invasive to the
kernel. I think it is a very interesting idea for 2.7, and should be
floated past the maintainers who will be impacted to see if it has a
hope in hell.
Crispin
-- Crispin Cowan, Ph.D. Chief Scientist, WireX http://wirex.com/~crispin/ Security Hardened Linux Distribution: http://immunix.org Available for purchase: http://wirex.com/Products/Immunix/purchase.html Just say ".Nyet"
--=_courier-30108-1044848512-0001-2 Content-Type: application/pgp-signature Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQE+Rx8o5ZkfjX2CNDARAaf4AJ96UU5EQ1qTi0fu9OUt0LU77y8rYwCfRNE7 vzwilVzhD8It1Y9IkMieYgs= =D4oT -----END PGP SIGNATURE-----
--=_courier-30108-1044848512-0001-2--