linux-kernel - Re: [TOMOYO 14/15] Conditional permission support.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 27 Aug 2007 08:11:15 -0400
From:	Kyle Moffett <mrmacman_g4@....com>
To:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Cc:	pavel@....cz, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org, chrisw@...s-sol.org
Subject: Re: [TOMOYO 14/15] Conditional permission support.

On Aug 25, 2007, at 22:13:48, Tetsuo Handa wrote:
> Pavel Machek wrote:
>> What is that? Language parser in kernel?
>
> Yes. This is a policy parser in kernel.
>
> TOMOYO Linux' policy is passed from/to the kernel as a plain text  
> (i.e. ASCII printable) file via /proc/tomoyo interface.
>
> For example, to add a permission to allow /usr/sbin/sshd to  
> execute /bin/bash if the authenticated user's uid = 500, the  
> administrator runs
>
> # /bin/cat > /proc/tomoyo/domain_policy << EOF
> select <kernel> /usr/sbin/sshd
> 1 /bin/bash if task.uid=500
> EOF

This is probably not acceptable; I doubt there's a chance in hell  
that TOMOYO will get merged as long as it has text-based-language  
parsing in the kernel.  You also have $NEW_RANDOM_ABUSE_OF_PROCFS and  
$PATH_BASED_LSM_ISSUES.  See the long flamewars on AppArmor for  
discussion on the latter.

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/