lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 3 Nov 2006 21:08:55 -0500
From:	Kyle Moffett <mrmacman_g4@....com>
To:	"Serge E. Hallyn" <serue@...ibm.com>
Cc:	Stephen Smalley <sds@...ho.nsa.gov>,
	20060906182719.GB24670@...gelap.austin.ibm.com,
	linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] security: introduce fs caps

On Nov 03, 2006, at 15:47:06, Serge E. Hallyn wrote:
>  Quoting Stephen Smalley (sds@...ho.nsa.gov):
>> On Fri, 2006-11-03 at 14:00 -0600, Serge E. Hallyn wrote:
>>> One question is, if this were to be tested in -mm, do we want to  
>>> keep
>>> this mutually exclusive from selinux through config, or should  
>>> selinux
>>> stack on top of this?
>>
>> Given that SELinux already stacks with capability and you aren't  
>> using
>> the security fields (last I looked), it would seem trivial to enable
>> stacking with fscaps (just add a few secondary_ops calls to the  
>> SELinux
>> hooks, right?).
>
> Yup, I just wasn't sure if there would be actual objections to the  
> idea of enabling both at once.
>
> I'll send out a patch - just as soon as I figure out where I left  
> the src to begin with :)

To be honest from my understanding of SELinux there is no need at all  
to use FS caps on an SELinux system.  Anything that could be done  
with FS caps would be done in a much more fine-grained method with  
SELinux, and the inheritance of filesystem-based capabilities should  
be masked by SELinux-allowed capabilities anyways.  I guess it _can_  
be done, but why?  It's possible to set up an SELinux system so that  
there aren't even any SUID binaries, right?  /etc/passwd can run as  
whatever random user and it will automatically transition to the  
appropriate domain such that it can read and modify /etc/shadow.

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists