lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 3 Nov 2006 21:08:55 -0500 From: Kyle Moffett <mrmacman_g4@....com> To: "Serge E. Hallyn" <serue@...ibm.com> Cc: Stephen Smalley <sds@...ho.nsa.gov>, 20060906182719.GB24670@...gelap.austin.ibm.com, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH 1/1] security: introduce fs caps On Nov 03, 2006, at 15:47:06, Serge E. Hallyn wrote: > Quoting Stephen Smalley (sds@...ho.nsa.gov): >> On Fri, 2006-11-03 at 14:00 -0600, Serge E. Hallyn wrote: >>> One question is, if this were to be tested in -mm, do we want to >>> keep >>> this mutually exclusive from selinux through config, or should >>> selinux >>> stack on top of this? >> >> Given that SELinux already stacks with capability and you aren't >> using >> the security fields (last I looked), it would seem trivial to enable >> stacking with fscaps (just add a few secondary_ops calls to the >> SELinux >> hooks, right?). > > Yup, I just wasn't sure if there would be actual objections to the > idea of enabling both at once. > > I'll send out a patch - just as soon as I figure out where I left > the src to begin with :) To be honest from my understanding of SELinux there is no need at all to use FS caps on an SELinux system. Anything that could be done with FS caps would be done in a much more fine-grained method with SELinux, and the inheritance of filesystem-based capabilities should be masked by SELinux-allowed capabilities anyways. I guess it _can_ be done, but why? It's possible to set up an SELinux system so that there aren't even any SUID binaries, right? /etc/passwd can run as whatever random user and it will automatically transition to the appropriate domain such that it can read and modify /etc/shadow. Cheers, Kyle Moffett - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists