Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: Casey Schaufler <casey <at> schaufler-ca.com>
Subject: Re: [RFC] cgroups: implement device whitelist lsm (v2)
Newsgroups: gmane.linux.kernel.lsm
Date: Friday 14th March 2008 02:51:19 UTC (over 9 years ago)
--- James Morris  wrote:

> On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
> 
> > Quoting James Morris ([email protected]):
> > > On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
> > > 
> > > > True, but while this change simplifies the code a bit, the
semantics
> > > > seem more muddled - devcg will be enforcing when
CONFIG_CGROUP_DEV=y
> > > > and:
> > > > 
> > > > 	SECURITY=n or
> > > > 	rootplug is enabled
> > > > 	capabilities is enabled
> > > > 	smack is enabled
> > > > 	selinux+capabilities is enabled
> > > 
> > > Well, this is how real systems are going to be deployed.
> > 
> > Sorry, do you mean with capabilities?
> 
> Yes.
> 
> All Fedora, RHEL, CentOS etc. ship with SELinux+capabilities.  I can't 
> imagine not enabling them on other kernels.
> 
> > > It becomes confusing, IMHO, if you have to change which secondary LSM
you
> 
> > > stack with SELinux to enable a cgroup feature.
> > 
> > So you're saying selinux without capabilities should still be able to
> > use dev_cgroup?  (Just making sure I understand right)
> 
> Nope, SELinux always stacks with capabilities, so havng the cgroup hooks 
> in capabilities makes sense (rather than having us change the secondary 
> stacking LSM just to enable a feature).

That's what I was getting at. When the next feature comes along
are we going to stuff it into capabilities, too? Maybe we'll
cram it into audit or CIPSO instead, but how long can this go on?
Eventually we need a mechanism that allows more or less general
mix-and-match, maybe with a few rules like "don't mix plaids and
stripes" to keep things sane or these lesser facilities have no
chance. Seems like we're still making LSM too hard to use.

Unless I take an aggressive approach to adding them to Smack.
Hmm, might be a way to make a buck or two that way.
(Only kidding)(Well, mostly only kidding)

And yes, I understand that there are still those about who
don't like LSM in any form, much less in a useful one.


Casey Schaufler
[email protected]
--
To unsubscribe from this list: send the line "unsubscribe
linux-security-module" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
 
CD: 3ms